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Section I 

INTRODUCTORY REMARKS 

Fancnph 

The essential difference between monoalphabetic and polyalphabetic substitution 1 

Primary classification of polyalphabetic systems. 2 

Pnmary classification of periodic systems 3 

Sequence of study of polyalphabetic systems 4 

1. The essential difference between monoalphabetic and polyalphabetic substitution. — a. 
In the substitution methods thus far discussed it has been pointed out that their basic feature 
is that of monoalphabeticity. From the cryptanalytic standpoint, neither the nature of the 
cipher symbols, nor their method of production is an essential feature, although these may be 
differentiating characteristics from the cryptographic standpoint It is true that in those cases 
designated as monoalphabetic substitution with variants or multiple equivalents, there is a 
departure, more or less considerable, from strict monoalphabeticity. In some of those cases, 
indeed, there may be available two or more wholly independent sets of equivalents, which, 
moreover, may even be arranged m the form of completely separate alphabets. -Thus, while a 
loose terminology might permit one to designate such systems as polyalphabetic, it is better to 
reserve this nomenclature for those cases wherem polyalphabeticity is the essence of the method, 
specifically introduced with the purpose of imparting a positional variation in the substitutive 
equivalents for plain-text letters, in accordance with some rule directly or indirectly connected 
with the absolute positions the plain-text letters occupy in the message. This point calls for 
amplification. 

b. In monoalphabetic substitution with variants the object of having different or multiple 
equivalents is to suppress, so far as possible by simple methods, the characteristic frequencies 
of the letters occurring in plain text. As has been noted, it is by means of these characteristic 
frequencies that the cipher equivalents can usually be identified In these systems the varying 
equivalents for plain-text letters are subject to the free choice and caprice of the enciphering 
clerk; if he is careful and conscientious in the work, he will really make use of all the different 
equivalents afforded by the system, but if he is slip-shod and hurried in his work, he will use the 
same equivalents repeatedly rather than take pains and time to refer to the charts, tables, or 
diagrams to find the variants Moreover, and this is a crucial point, even if the individual 
enciphering clerks are extremely careful, when many of them employ the same system it is entirely 
impossible to insure a complete diversity in the encipherments produced by two or more clerks 
working at different message centers. The result is inevitably to produce plenty of repetitions 
in the texts emanating from several stations, and when texts Buch as these are all available for 
study they are open to solution, by a comparison of their similarities and differences. 

c. In true polyalphabetic systems, on the other hand, there is established a rather definite 
procedure which automatically determines the shifts or changes in equivalents or in the manner 
in which they are introduced, so that these changes are beyond the momentary whim or choice of 
the enciphering clerk. When the method of shifting or changing the equivalents is scientifically 
sound and sufficiently complex, the research necessary to establish the values of the cipher 
characters is much more prolonged and difficult than is the case even m complicated monoalpha- 
betic substitution with vanants, as will later be seen. These are the objects of true polyalpha- 
betic substitution systems. The number of such systems is quite large, and it will be possible to 

(l) 
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describe in detail the cryptanalysis of only a few of the more common or typical examples of 
methods encountered in practical military communications. 

d. The three methods, (1) single-equivalent monoalphabetic substitution, (2) monoalpha- 
betic substitution with variants, and (3) true polyalphabetic substitution, show the following 
relationships as regards the equivalency between plain-text and cipher-text units: 

A. In method (1), there is a set of 26 symbols; a plain-text letter is always represented by 
one and only one of these symbols; conversely, a symbol always represents the same plain-text 
letter. The equivalence between the plain-text and the cipher letters is constant in both enci- 
pherment and decipherment. 

B. In method (2), there is a set of n symbols, where n may be any number greater than 26 
and often is a multiple of that number; a plain-text letter may be represented by 1, 2, 3, . . . 
different symbols; conversely, a symbol always represents the same plain-text letter, the same as 
iB the case in method (1). The equivalence between the plain-text and the cipher letters is 
variable in encipherment but constant in decipherment 1 

C. In method (3) there is, as in the first method, a set of 26 symbols; a plain-text letter 

may be represented by 1, 2, 3, . . . 26 different symbols; conversely, a symbol may represent 
1, 2, 3, 26 different plain text letters, depending upon the system and the specific key. 

The equivalence between the plain-text and the cipher letters is variable in both encipherment 
and decipherment. 

2. Primary classification of polyalphabetic systems. — a. A primary classification of poly- 
alphabetic systems into two rather distinct types may be made: (1) periodic systems and (2) 
aperiodic systems When the enciphering process involves a cryptographic treatment which is 
repetitive in character, and which results m the production of cyclic 'phenomena in the crypto- 
graphic text, the system is termed periodic. When the enciphering process is not of the type 
described in the foregoing general terms, the system is termed aperiodic. The substitution in 
both cases involves the use of two or more cipher alphabets. 

b. The cyclic phenomena inherent in a periodic system may be exhibited externally, in 
which case they are said to be patent, or they may not be exhibited externally, and must be un- 
covered by a preliminary step in the analysis, in which cose they are said to be latent. The 
periodicity may be quite definite in nature, and therefore determinable with mathematical 
exactitude allowing for no variability, in which case the periodicity is said to beared. In other 
instances the periodicity is more or less flexible in character and even though it may be deter- 



1 There is a monoalphabetic method in which the inverse result obtains, the correspondence being constant 
in encipberxne it but variable in decipherment; this is a method not found m the usual bookB on cryptography 
but in an essay on that subject by Edgar Allan Poe, entitled, in some editions of his works, A few words on secret 
writing and, in other editions, Cryptography. The method is to draw up an enciphering alphabet such as the 
following (using Foe's example) 



Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher. SUAVXTERXNMODOFORTXTERXNRB 

In such an alphabet, because of repetitions in the cipher component, the plain-text equivalents are subject to a 
considerable degree of variability, as will be seen in the deciphering alphabet 



Cipher., 



Plain 



BCDEFGHXJKLMNOPQRSTUVWXYZ 
UGO E KJL HAFBD 

U X X N Q R 

Z S PVT 

W Y 



This type of variability gives rise to ambiguities in decipherment A cipher group such as TIE, would yield 
such plain-text sequences as REG, FXG, TEU, REU, etc , which could be read only by context. Mo system of such a 
character would be practical for serious usage. For a further discussion of this type of cipher alphabet see 
Friedman, William F, Edgar Allan Poe , Cyr/Uographer, Signal Corps Bulletins Nos 97 (July-Sept) and 98 
(Oct -Dec), 1937 
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minable mathematically, allowance must be made for a degree of variability subject to limits 
controlled by the specific system under mvestigation. The pcnodicity is in this case said to be 
■flexible, or variable within limits. 

3. Primary classification of periodic systems . — a Periodic polyalphabetic substitution 
systems may primarily be classified into two kinds* 

(1) Those in which only a few of a whole set of cipher alphabets are used in enciphering 
individual messages, these alphabets being employed repeatedly in a fixed sequence throughout each 
message. Because it is usual to employ a secret word, phrase, or number as a key to determine 
the number, identity, and sequence with which the cipher alphabets are employed, and this 
key is used over and over again in encipherment, this method is often called the repeahng-key 
system, or the repeating-alphabet system It is also sometimes referred to as the multiple-alpha- 
bet system because if the keying of the entire message be considered as a whole it is composed 
of multiples of a short key used repetitively.* In this text the designation “repeating-key 
system” will be used. 

(2) Those in which all the cipher alphabets comprising the complete set for the system ore 
employed one after the other successively in the encipherment of a message, and when the 
last alphabet of the series has been used, the encipheier begins over again with the first alphabet. 
This is commonly referred to as a progressive-alphabet system because the cipher alphabets are 
used in progression. 

4. Sequence of study of polyalphabetic systems. — a. In the studies to be followed m con- 
nection with polyalphabetic systems, the order in which the work will proceed conforms very 
closely to the classifications made in paragraphs 2 and 3 Periodic polyalphabetic substitution 
ciphers will come first, because they are, as a rule, the simpler and because a thorough under- 
standing of the principles of their analysis is prerequisite to a comprehension of how aperiodic 
ByBtems are solved. But m the final analysis the solution of examples of both types rests upon 
the conversion or reduction of polyalphabeticity into monoalphabeticity. If this is possible, 
solution can always be achieved, granted there are sufficient data in the final monoalphabetic 
distributions to permit of solution by recourse to the ordinary principles of frequency. 

6, First in the order of study of periodic systems will come the analysis of repeatmg-key 
systems. Some of the more simple varieties will be discussed m detail, with examples. Subse- 
quently, ciphers of the progressive type will bo discussed. There will then follow a more or less 
detailed treatment of aperiodic systems. 



* French terminology calls this the "double-key method", but there is no logic m such nomenclature 
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Section II 

CIPHER ALPHABETS FOR POLYALPHABETIC SUBSTITUTION 

Fusgnph 

Classification of cipher alphabets upon the basis of their derivation 5 

Primary components and secondary alphabets.- 6 

Primary components, cipher disks, and square tables. 7 

5. Classification of cipher alphabets upon the basis of their derivation. — a. The substitu- 
tion processes in polyalphabetic methods involve the use of a plurality of cipher alphabets. 
The latter may be derived by various schemes, the exact nature of which determines the principal 
characteristics of the cipher alphabets and plays a very important role m the preparation and 
solution of polyalphabetic cryptograms. For these reasons it is advisable, before proceeding to a 
discussion of the principles and methods of analysis, to point out these various types of cipher 
alphabets, show how they are produced, and how the method of their production or derivation 
may be made to yield important clues and short-cuts in analysis. 

b. A primary classification of cipher alphabets for polyalphabetic substitution may be made 
into the two following types' 

(1) Independent or unrelated cipher alphabets. 

(2) Derived or interrelated cipher alphabets 

e Independent cipher alphabets may be disposed of in a very few words They are merely 
separate and distinct alphabets showing no relationship to one another in any way. They may 
be compiled by the various methods discussed m Section IX of Elementary Military Cryptography. 
The solution of cryptograms written by means of such alphabets is rendered more difficult by 
reason of the absence of any relationship between the equivalents of one cipher alphabet and 
those of any of the other alphabets of the same cryptogram. On the other hand, from the point of 
view of practicability in their production and their handling in cryptographing and decryptograph- 
mg, they present some difficulties which make them less favored by cryptographers than cipher 
alphabets of the second type. 

d. Derived or interrelated alphabets, as their name indicates, are most commonly produced 
by the interaction of two primary components, which when juxtaposed at the various points of 
coincidence can be made to yield secondary alphabets 1 

6. Primary components and secondary alphabets. — Two basic, slidable sequences or com- 
ponents of n characters each will yield n secondary alphabets The components may be classi- 
fied according to various schemes For cryptanalytic purposes the following classification will be 
found useful 

Case A The primary components are both normal sequences. 

(1) The sequences proceed in the same direction (The secondary alphabets are direct 
standard alphabets ) (Pars. 13-15 ) 

(2) The sequences proceed in opposite directions. (The secondary alphabets are reversed 
standard alphabets, they are also reciprocal cipher alphabets.) (Par 13i, 14g ) 

Case B The primary components are not both normal sequences. 

(1) The plain component is normal, the cipher component is a mixed sequence. (The 
secondary alphabets are mixed alphabets.) (Par , 16-25 ) 

1 See Sec. VIII and IX, Elementary Military Cryptography. 

( 4 ) 
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(2) The plain component is a mixed sequence, the cipher component is normal. (The 
secondary alphabets are mixed alphabets.) (Par. 26.) 

(3) Both components are mixed sequences. 

(a) Components are identical mixed sequences. 

I. Sequences proceed in the same direction. (The secondary alphabets are 
mixed alphabets.) (Par. 28.) 

11 Sequences proceed in opposite directions. (The secondary alphabets are 
reciprocal mixed alphabets.) (Par. 38.) 

(b) Components are different mixed sequences. (The secondary alphabets are mixed 

alphabets.) (Par. 39.) 

7. Primary components, cipher disks, and square tables. — a. In preceding textB it has 
been shown that the equivalents obtainable from the use of quadricular or square tables may be 
duplicated by the use of revolving cipher disks or of sliding primary components. It was also 
stated that there are various ways of employing such tables, disks, and sliding components. 
Cryptographically the results may be quite diverse from different methods of using such para- 
phernalia, since the specific equivalents obtained from one method may be altogether different 
from those obtained from another method. But from the cryptanalytic point of view the 
diversity referred to is of little significance; only in one or two cases does the specific method of 
employing these cryptographic instrumentalities have an important bearing upon the procedure 
in cryptanalysis. However, it is advisable that the student learn something about these different 
methods before proceeding with further work. 

b. There are, not two, but jour letters involved in every case of finding equivalents by means 
of sliding primary components; furthermore, the determination of an equivalent for a given 
plain-text letter is representable by two equations involving four elements, usually letters. 
Three of these letters are by this time well-known to and understood by the student, viz, 6k, 6p, 
and 9 e . The fourth element or letter has been passed over without much comment, but crypto- 
graphically it is just as important a factor as the other three. Its function may best be indicated 
by noting what happens when two primary components are juxtaposed, for the purpose of finding 
equivalents. Suppose these components are the following sequences: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWN0X 

Now suppose one is merely asked to find the equivalent of P p when the key letter is K. Without 
further specification, the cipher equivalent cannot be Btated; for it is necessary to know not only 
which K will be used as the key letter, the one in the component labeled (1) or the one in the 
component labeled (2), but also what letter the K k will be set against, in order to juxtapose the 
two components. Most of the time, in preceding texts, these two factors have been tacitly 
assumed to be fixed and well understood: the K k is sought in the mixed, or cipher component, 
and this K is set against A in the normal, or plain component. Thus: 

Plain Index 

i I 

(1) Plain ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) Cipher FBPYRCQZIGSEHTDJUMKVALWNOX 

t T 

Cipher Key 



With this setting P p =Z, 
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e. The letter A in this case may be termed (he index letter, symbolized A|. The index letter 
constitutes the fourth element involved in the two equations applicable to the finding of equiva- 
lents by sliding components. The four elements are therefore these: 

(1) The key letter, 0k 

(2) The index letter, 9 ( 

(3) The plain-text letter, 6 P 

(4) The cipher letter, 0, 

The index letter is commonly the initial letter of the component; but this, too, is only a con- 
vention. It might be any letter of the sequence constituting the component, as agreed upon by 
the correspondents. However, in the subsequent discussion it will be assumed that the index letter 
is the initial letter oj the component in which it is located, unless otherwise stated. 

d In the foregoing case the enciphering equations are as follows: 

(I) K*=A,; P,=Z. 

But there is nothing about the use of sliding components which excludes other methods of finding 
equivalents than that shown above. For instance, despite the labeling of the two components 
as shown above, there is nothing to prevent one from seeking the plain-text letter in the com- 
ponent labeled (2), that is, the cipher component, and taking as its cipher equivalent the letter 
opposite it m the other component labeled (1). Thus; 

Cipher Index 

1 ! 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALffNOX 

T t 

Plain Key 

Thus: 

(II) K*=A,; P„=K, 

e. Since equations (I) and (II) yield different resultants, even with the same index, key, 
and plain-text letters, it is obvious that an accurate formula to cover a specific pair of enciphering 
equations must include data showing in what component each of the four letters comprising the 
equations is located. Thus, equations (I) and (II) should read: 

(I) K k in component (2)=A, in component (1); P p in component (l)=Z e in component (2). 

(II) K k in component (2) = A, in component (1); P D in component (2)= K« in component (1). 

For the sake of brevity, the following notation, will be used: 

(1) Kn/i=Ai/i; P s/ i=Z,/j 

(2) K k /s=A|/t; P#/i=K t /i 

/. Employing two sliding components and the four letters entering into an enciphering 
equation, there are, in all, twelve different resultants possible for the same set of components 
and the same set of four basic elements. These twelve differences in resultants arise from a set 
of twelve different enciphering conditions, as set forth below (the notation adopted in sub- 
paragraph e is used): 

(1) ®k»=0ia; 0pfl=9*/i (7) B*n—Qpn‘> 9i »=0»n 

(2) ^B=0Hi; 0p/i*=0«n (8) 9*?*— 9«ni 0i«=0pA 

(3) O k fl=0i/*; 6p/i— 0«/a (9) 0p/»» 0i/i— 

(4) 9*/i— 0i/»; 0p/*= 0./i (10) 0»fl= 9./*; 0i/i=9 p /i 

(5) 0k/*=0#/i; 0in— 0»n (ll) Qk/i^Gp/*; 0i/i=0«/i 

(8) 0ta=0«Ai 0in— 0p« (12) 0 k /i=0«/»; 0 ux=0»a 
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g. The twelve resultants obtainable from juxtaposing sliding components as indicated under 
the preceding subparagraph may also be obtained either from one square table, in which case 
twelve different methods of finding equivalents must be applied, or from twelve different square 
tables, in which case one standard method of finding equivalents will serve all purposes. 

h. If but one table such as that shown below as Table I-A is employed, the various methods 
of finding equivalents are difficult to keep in mind.* 

Tablh I-A 



A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


X 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


V 


X 


Y 


z 


F 


B 


P 


Y 


R 


C 


Q 


Z 


I 


G 


s 


a 


□ 


E3 


D 


J 


0 


a 


11 


n 


A 


L 


W 


N 


□ 


n 


B 


P 


Y 


R 


C 




Z 


I 


G 


S 


a 


a 


Q 




J 


U 


n 


Q 


V 


Q 


L 


W 


N 


0 


X 


Q 


P 


Y 


R 


C 


Q 




I 


G 


S 


a 


a 


Q 




□ 


a 


M 






A 


gj 


W 


N 


0 


X 


F 


B 


Y 


R 


C 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


a 


□ 


K 


Q 




L 


0 


N 


0 


X 


F 


B 


P 


R 


C 


Q 


Z 


I 


G 


S 


E 


H 


T 


a 


a 


u 


Ml 


X 


V 


Q 




W 


n 


0 


X 


F 


B 


P 


Y 


C 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


j 


U 




a 


V 


A 


L 


13 


N 


0 


x 


F 


B 


P 


Y 


R 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


u 


M 




□ 


A 


L 


W 




0 


X 


F 


B 


P 


Y 


R 


c 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


IT 


M 


a 




□ 


L 


W 


N 


0 


X 


F 


B 


P 




R 


C 


Q 


I 


G 


S 


E 


rH 


T 


D 


J 


U 


M 


X 


0 


a 


a 


W 


N 


0 


X 


F 


B 


P 


Y 


a 


C 


Q 


z 


0 


S 




JL 


T 


D 


J 


U 


M 


K 


V 


A 


a 


□ 


N 


0 


X 


F 


B 


P 


Y 


R 


a 


Q 


Z 


I 


0 


E 


yi 


T 


D 


J 


□ 


□ 


K 


V 


A 


a 


□ 


N 


0 


X 


F 


B 


P 


Y 


R 


C 


0 


z 


I 


a 


0 


H 


E3 


D 


J 


U 


□ 


K 


V 


A 


L 


□ 


□ 


0 


X 


F 


B 


P 


□ 


R 


C 


Q 


z 


I 


G 


s 


n 


T 


D 


J 


U 


□ 


K 


V 


D 


L 


W 


□ 




E3 


F 


B 


□ 


Q 


R 


jQj 


Q 


Z 


I 


G 


S 


E 


Q 


D 


□ 


U 


M 


Q 


V 


A 




W 


N 


a 


□ 


a 


B 


P 


Y 


0 


C 


n 


z 


I 


G 


S 


E 


a 




J 


□ 


M 


K 


Q 


A 


L 


O 


N 


0 


Q 


a 


a 


P 


Y 


R 


c 


Q 


z 


I 


G 


S 


E 


H 


T 


□ 


U 


H 


n 


V 


D 


L 


W 


0 


0 


X 


□ 


B 


p 


Y 


R 


C 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


□ 


M 


K 




A 


Q 


W 


N 


0 


X 


F 


B 


P 


Y 


R 


C 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


□ 


K 


V 


Q 


L 


Q 


N 


0 


X 


F 


B 


P 


Y 


R 


C 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


0 


□ 


V 


A 




W 


y 


0 


X 


F 


B 


P 


□ 


R 


e 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


U 


0 


Q 


A 


L 


□ 


N 


0 


X 


F 


B 


P 


Y 


m 


□ 


0 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


u 


M 


U 




L 


If 


D 


0 


□ 


F 


B 


P 


Y 


R 


m 






I 


G 


S 


E 


H 


T 


0 


J 


U 


M 


X 




K3 


V 


N 


o 


X 


F 


B 


P 


Y 


R 


C 


h 


n 


Q 


G 


S 


E 


H 


T 


D 


J 


U 


M 


X 


V 


0 


□ 


N 


0 


Q 


F 


B 


P 


Y 


R 


C 


Q 


a 


□ 


0 


0 


E 


H 


T 


D 


J 


U 


M 


K 


V 


A 


Q 


Q 


0 


X 


U 


B 


P 


□ 


R 


C 


Q 


z 


T 


G 


is 


E 


H 


T 


D 


J 


U 


M 


X 


Q 


A 


L 


w 


Q 


□ 


□ 


n 


□ 


ID 


□ 


C 


Q 


z 


I 


□ 


0 


□ 


H 


T 


D 


J 


U 


M 


X 


V 


n 


L 


W 


N 


□ 


B 


□ 


B 


B 


IB 


B 


Q 


z 


I 


G 


B 


B 


i 


IB 


D 


J 


U 


11 


X 


V 


A 


B 


W 


□ 


B 



For example: 

(1) For enciphering equations Q» / ,=0| /1 ; 6 p /i =©,/»: 

Locate 6^ in top sequence; locate 0^ in first column; 

6. is letter within the square at intersection of the two lines thus determined. 
Thus: 



P p/1 =Z.„ 
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(2) For enciphering equations 0»/i=9i/i; Q B ii=Q e n‘- 

Locate 0* in first column; follow line to right to 0 D ; proceed up this column; 6 0 is 
letter at top. 

Thus: 

K*/»= A|/ij P p /j=K e / 1 

(3) For enciphering equations 0k/i=0i/aJ 0 P /i=0«/j: 

Locate 0k m top sequence and proceed down column to 0 f ; 

Locate 0 D in top sequence; 0, is letter at other corner of rectangle thus formed. 
Thus: 

Kk/i=A| fl ; Pp/i=X 0 /j 



Only three different methods have been shown and the student no doubt already has encountered 
difficulty in keeping them segregated in his mind It would obviously be very confusing to try 
to remember all twelve methods But if one standard or fixed method of finding equivalents is 
followed with several different tables, then this difficulty disappears. Suppose that the following 
method is adopted: Arrange the square so that the plain-text letter may be sought in a separate 
sequence, arranged alphabetically, above the square and so that the key letter may be sought 
in a separate sequence, also arranged alphabetically, to the left of the square; look for the plain- 
text letter in the top row, locate the key letter in the 1st column to the left; find the letter stand- 
ing within the square at the intersection of the vertical and horizontal lines thus determined. 
Then twelve squares, equivalent to the twelve different conditions listed in subparagraph/, can 
readily be constructed. They are all shown in Appendix 1, pp. 96-107. 

i. When these square tables are examined carefully, certain interesting points are noted. 
In the first place, the tables may be paired so that one of a pair may serve for enciphering and the 
other of the pair may serve for deciphering, or vice versa. For example, tables I and II bear this 
reciprocal relationship to each other; III and IV, V and VI, VII and VIII, IX and X, XI and 
XII. In the second place, the internal dispositions of the letters, although the tables are derived 
from the same pair of components, are quite diverse. For example, in table I-B the horizontal 
sequences are identical with those of Table 1-A, but are merely displaced to the right and to the 
left different intervals according to the successive key letters Hence this square shows what 
may be termed a horizontally-displaced, direct symmetry of the cipher component Vertically, 
it shows no symmetry, or if there is symmetry, it is not visible * But when Table I-B is more 
carefully examined, an invisible, or indirect, vertical symmetry may be discerned where at first 
glance it is not apparent If one takes any two columns of the table, it is found that the interval 
between the members of any pair of letters in one column is the same as the interval between the 
members of the homologous pair of letters in the other column, if the distance is measured on the 
cipher component For example, consider the 2d and 15th columns (headed by L and I, respec- 
tively), take the letters P and G in the 2d column, and J and ff m the 15th column The distance 
between P and G on the cipher component is 7 intervals; the distance between J and W on the same 
component is also 7 intervals This phenomenon implies a kind of hidden, or latent, or indirect 
symmetry within the cipher square In fact, it may be stated that every table which sets forth 
in systematic fashion the various secondary alphabets derivable by sliding two primary sequences 
through all points of coincidence to find cipher equivalents must show Borne kind of symmetry, 

* It is true that the first column within the table shows the plain-component sequence, but this is merely 
because the method of finding the equivalents in this case is such that this sequence is bound to appear In that 
column, since the successive key lettere are A, B, C, . . . Z, and this sequence happens to be identical with 
the plain component in this case. The same la true of Tables V and XI; it is also applicable to the first row of 
Tables IX and X. 
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both horizontally and vertically The symmetry may be termed visible or direct, if the sequences 
of letters m the rows (or columns) are the same throughout and are identical with that of one 
of the primary components, it may be termed hidden or indirect if the sequences of letters in the 
rows or columns are different, apparently not related to either of the components, but are in 
reality decimations of one of the primary components 

3 . When the twelve tables of Appendix 1 are examined in the light of the foregoing remarks, 
the type of symmetry found in each may be summarized in the following manner: 





Horizontal 


Vertical 


Table 


Visible or direct 


Invisible or Indirect 


VWbla or direct 


Invisible or Indirect 




Follows 

plain 

component 


Follows 

cipher 

component 


Follows 

plain 

component 


Follows 

cipher 

component 


Follows 

plain 

component 


Follows 

cipher 

component 


Follows 

plain 

component 


Follows 

cipher 

component 


I 




X 












X 


II 






x 








x 




Ill 




X 








X 






IV 






X 




X 








V 




X 












x 


VI 






x 








X 




VII 


x 












X 




VIII 


X 












X 




IX 








X 








x 


X 








x 








x 


XI 






X 




x 








XII 




X 








X 

























Of these twelve types of cipher squares, corresponding to the twelve different ways of using a 
pair of sliding primary components to denve secondary alphabets, the ones best known and 
most often encountered in cryptographic studies are Tables I-B and II, referred to as being of 
the Vigenfere type; Tables V and VI, referred to as bang of the Beaufort type, and Tables IX 
and X, referred to as being of the Delastelle type. It will be noted that the tables of the Dela- 
stelle type show no direct or visible symmetry, either horizontally or vertically and because of 
this are supposed to yield more security than do any of the other types of tables. But it will 
presently be shown that the supposed increase in security is more illusory than real 

k. The foregoing facts concerning the various types of quadricular tables generated by diverse 
methods of using sliding primary components or their equivalent rotating cipher disks will be 
employed to good advantage, when the studies presently to be undertaken will bring the student 
to the place where he can comprehend them in the analysis of polyalphabetic systems. But in 
order not to confuse him with a multiplicity of details which have no direct bearing upon basic 
principles, one and only one standard method of finding equivalents by means of sliding compo- 
nents will be selected from among the twelve available, as set forth in the preceding subpara- 
graphs. Unless otherwise stated, this method will be the one denoted by the first of the formulae 
listed in subpar./, viz: 

©fcfl— 6|/1> ©p/l=0ofl 

Calling the plain component “l” and the cipher component “2”, this will mean that the keyletter 
on the cipher component will be set opposite the index, which will be the first letter of the plain 
component; the plain-text letter to be enciphered will then be sought on the plain component and 
its equivalent will be the letter opposite it on the cipher component. 
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Section III 

THEORY OF SOLUTION OF REPEATING-KEY SYSTEMS 

hapqt 



The three steps in the analysts of repeating-key systems 8 

first step: finding the length of the period I 9 

General remarks on factoring ... 10 

Second step: distributing the cipher text into the oomponent monoalphabets 11 

Third step: solving the monoalphabetio distributions 12 



8. The three steps in the analysis of repeating-key systems. — a. The method of enciphering 
according to the principle of the repeating key, or repeating alphabets is adequately explained in 
Section XI of Elementary Military Cryptography, and no further reference need be made at this 
time. The analysis of a cryptogram of this type, regardless of the kind of cipher alphabets 
employed, or their method of production, resolves itself into three distinct and successive steps. 

(1) Determination of the length of the repeating key, which is the same as the determination 
of the exact number of alphabets involved in the cryptogram; 

(2) Allocation or distribution of the letters of the cipher text into the respective cipher alpha- 
bets to which they belong. This is the step which reduces the polyalphabetic text to mono- 
alphabetic terms, 

(3) Analysis of the individual monoalphabetic distributions to determine plain-text values of 
the cipher letters in each distribution or alphabet. 

b. The foregoing steps will be treated in the order in which mentioned The first step may 
be described briefly as that of determining the period The second Btep may he described briefly 
as that of reduction to monoalphabetic terms. The third step may be designated as identification of 
cipher-teat values. 

9. First step: finding the length of the period. — a. The determination of the period, that 
is, the length of the key or the number of cipher alphabets involved in a cryptogram enciphered 
by the repeating-key method is, as a rule, a relatively simple matter. ‘[Hie cryptogram itself 
usually manifests externally certain phenomena which are the direct result of the use of a repeat- 
ing key. The principles involved are, however, so fundamental in cryptanalysis that their 
elucidation warrants a somewhat detailed treatment. This will be done in connection with a 
short example of encipherment, shown in Fig. 1. 

Message 

THE ARTILLERY BATTALION MARCHING IN THE REAR OF THE ADVANCE GUARD KEEPS 
ITS COMBAT TRAIN WITH IT INSOFAR AS PRACTICABLE. 

( 10 ) 
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(Key: BLUE, using direct standard alphabets] 

Cipher Alphabets 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(1) BCDEFGHIJKLMNOPQRSTUVWXYZA 

Cipher (2) LMNOPQRSTUVWXYZABCDEFGHIJK 

(3) UVWXYZABCDEFGHIJKLMNOPQRST 

(4) EFGHIJKLMNOPQRSTUVWXYZABCD 



BLUE 


BLUE 


BLUE 


BLUE 


T H E A 


ARDK 


T H E A 
U S Y E 


ARDK 
B C X 0 


R T I L 


E E P S 


R T I L 
S E C P 


E E P S 
F P J W 


L E R Y 


I T S C 


L E R Y 
HPLC 


I T S C 
J E M G 


B A T T 


0 M B A 


B A T T 
C L N X 


0 M B A 
P X V E 


ALIO 


T T R A 


ALIO 
B W C S 


T T R A 
U E L E 


N M A R 


I N W I 


N M A R 
0 X U V 


I N ff I 
J Y Q M 


CHIN 


T H I T 


CHIN 
D S C R 


T H I T 
U S C X 


G I N T 


I N S 0 


G I N T 
H T H X 


I N S 0 
J Y M S 


HERE 


F A R A 


HERE 
I P L I 


F A R A 
G L L E 


A R 0 F 


S P R A 


A R 0 F 
B C I J 


S P R A 
TALE 


T H E A 


C T I C 


T H E A 
U S Y E 


C T I C 
D E C G 


D V A N 
C E G U 


ABLE 


D V A N 
E G U R 

C E G U 
D P A Y 


ABLE 
B N F I 


a 


a 


b 


b 



Cryptogram 

USYES ECPUP LCCLN XBVCS OXUVD SCRHT 

HXIPL IBCIJ USYEE GURDP AYBCX OFPJV 

JE11GP XVEUE LEJYQ M U S C X JYMSG LLETA 

LEDEC SBUFI 

Itaou L 
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b Regardless of what system is used, identical plain- text letters enciphered by the same 
cipher alphabet 1 must yield identical cipher letters Referring to Fig 1, such a condition is 
brought about every time that identical plain-text letters happen to be enciphered with the same 
key-letter, or every time identical plain-text letters fall into the same column in the encipher- 
ment 2 Now since the number of columns or positions with respect to the key is very limited 
(except in the case of veiy long key words), and since the repetition of letters is an inevitable 
condition in plain text, it follows that there will be in a message of fair length many cases where 
identical plain-text letters must fall into the same column. They will thus be enciphered by the 
same cipher alphabet, resulting, therefore, in the production of many identical letters m the 
cipher text and these will represent identical letters in the plain text When identical plain-text 
polygraphs fall into identical columns the result is the formation of identical cipher-text poly- 
graphs, that is, repetitions of groups of 2, 3, 4, . . . letters are exhibited in the cryptogram. 
Repetitions of this type will hereafter be called causal repetitions, because they are produced by 
a definite, traceable cause, viz, the encipherment of identical letters by the same cipher alphabets 

c. It will also happen, however, that different plain-text letters falling in different columns 
will, by mere accident, produce identical cipher letters. Note, for example, in Fig 1 that in 
Column 1, R p becomes S, and that in Column 2, H p also becomes S 0 . The production of an identical 
cipher text letter in these two cases (that is, a repetition where the plain-text letters are different 
and enciphered by different alphabets) is merely fortuitous. It is, in every day language, "a 
mere coincidence”, or ‘'an accident ” For this reason repetitions of this type will hereafter be 
called accidental repetitions. 

d. A consideration of the phenomenon pointed out in c makes it obvious that in polyalpha- 
betic ciphers it is important that the cryptanalyst be able to tell whether the repetitions he finds 
in a specific case are causal or accidental in their origin, that is, whether they represent actual 
encipherments of identical plain-text letters by identical keying elements, or mere coincidences 
brought about purely fortuitously. 

e Now accidental repetitions will, of course, happen fairly frequently with individual letters, 
but less frequently with digraphs, because in this case the same kind of an “accident” must take 
place twice in succession Intuitively one feels that the chances that such a purely fortuitous 
comcidence will happen two times in succession must be much less than that it will happen every 
once in a while m the case of single letters. Similarly, intuition makes one feel that the chances 
of such accidents happening in the case of three or more consecutive letters are still less than in 
the case of digraphs, decreasing very rapidly as the repetition increases in length. 

j. The phenomena of cryptographic repetition may, fortunately, be dealt with statistically, 
thus taking the matter outside the realm of intuition and putting it on a firm mathematical or 
objective basis Moreover, often the statistical analysis will tell the cryptanalyst when he has 
arranged or rearranged his text properly, that is, when he is approaching or has reached mono- 
alphabeticity in his efforts to reduce polyalphabetic text to its simplest terms. However, m 
order to preserve continuity of thought it is deemed inadvisable to inject these statistical con- 
siderations at this place in the text proper; they have been incorporated in Appendix 2 hereof. 
The student is advised to study the Appendix very carefully after he has finished reading this 
section of the text. 

g. At this point it will merely be indicated that if a cryptanalyst were to have at hand only 
the cryptogram of Fig. 1, with the repetitions underlined as below, a statistical study of the 

1 It is to be understood, of course, that cipher alphabets with single equivalents are meant in this case 

* The frequency with which this condition may be expected to occur can be definitely calculated. A dis- 
cussion of this point falls beyond the scope of the present text 
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number and length of the repetitions within the message (Par 5 of Appendix 2) would tell him 
that whde some of the digraphic repetitions may be accidental, the chances that they all are 
accidental are small. In the case of the tetragraphic repetition he would realize that the 
chances of its being accidental are very small indeed. 



A. 


USYE 


S 


E C 


B. 


S C R H 


T 


H X 


C. 


A Y B C_ 


_x 


0 F 


D. 


muse 


X 


J Y 



P M P L C C L N 

I P L I B C I J 

PJW JEMGP 
MSG LLETA 



X B W 


C S 


0 X U V D 


U S Y E E 


G U R D P 


X V E 


U E 


L E J Y Q 


LED 


E C 


GBKFI 



h. A consideration of the facts therefore leads to but one conclusion, viz, that the repetitions 
exhibited by the cryptogram under investigation are not accidental but are causal in their origin; 
and the cause is in this case not difficult to find: repetitions m the plain text were actually en- 
ciphered by identical alphabets In order for this to occur, it was necessary that the tetragraph 
USYE, for example, fall both times in exactly the same relative position with respect to the key. 
Note, for example, that USYE in Fig. 1 represents in both cases the plain-text polygraph THEA. 
The first time it occurred it fell in positions 1-2-3-4 with respect to the key; the second time it 
occurred it happened to fall m the very same relative positions, although it might ]ust as well 
have happened to fall m any of the other three possible relative positions with respect to the 
key, viz, 2-3-4-1, 3-4-1-2, or 4-1-2-3 

i. Lest the student be misled, however, a few more words are necessary on this subject. 
In the preceding subparagraph the word "happened’' was used; this word correctly expresses 
the idea in mind, because the insertion or deletion of a single plain-text letter between the two 
occurrences would have thrown the second occurrence one letter forward or backward, respec- 
tively, and thus caused the polygraph to be enciphered by a sequence of alphabets such as can 
no longer produce the cipher polygraph USYE from the plain-text polygraph THEA. On the 
other hand, the insertion or deletion of this one letter might bring the letters of some other 
polygraph into similar columns so that some other repetition would be exhibited m case the 
USYE repetition had thus been suppressed. 

3 The encipherment of similar letters by similar cipher alphabets is therefore the cause of 
the production of repetitions m the cipher text in the case of repeatmg-key ciphers. What 
principles can be derived from this fact, and how can they be employed in the solution of crypto- 
grams of this type? 

k. If a count is made of the number of letters from and including the first USYE to, but not 
including, the second occurrence of USYE, a total of 40 letters is found to intervene between the 
two occurrences. This number, 40, must, of course, be an exact multiple of the length of the key. 
Having the plain-text before ono, it is easily seen that it is the 10th multiple; that is, the 4-letter 
key has repeated itself 10 times between the first and the second occurrence of USYE. It follows, 
therefore, that if the length of the key were not known, the number 40 could safely be taken to 
be an exact multiple of the length of the key ; in other words, one of the factors of the number 
40 would be equal to the length of the key. The word "safely” is used m the preceding sentence 
to mean that the interval 40 applies to a repetition of 4 letters and it has been shown that the 
chances that this repetition is accidental are small. The factors of 40 are 2, 4, 5, 8, 10, and 20. 
So far as this single repetition of USYE is concerned, if the length of the key were not known, all 
that could be said about the latter would be that it is equal to one of these factors. The repeti- 
tion by itself gives no further indications. How can the exact factor be selected from among a 
list of several possible factors? 
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l. Let the intervals between all the repetitions in the cryptogram be listed. They are as 
follows 



Repetition 


Interval 


Factors 


1st. USYE tn 2d 1JSYE 


40 


2, 4, 5, 8, 10, 20 
2, 4, 8 


1st. BC tn 2d RC 


16 


1st CX tn 2d cx 


25 


5. 


1st EH tn 2 d EC 


88 


2, 4, 11, 22, 44 


1st LE to 2d T.E ... 


16 


2, 4, 8 


2H T.E tn 3d I.E 


4 


2, 4 


1st T.E tn 3H T.E 


20 


2, 4, 5, 10 


1st.JYto2dJY 


8 


2, 4 


1st PI. tn 2d PL 


24 


2, 3, 4, 6, 8, 10, 12 
2, 4, 13, 26 


1st SC to 2d SC. . .... _ 


52 


(1st SY to 2d SY, already included in USYE ) 

(1st US to 2d US, already included in USYE ) 

2d US to 3d US 


36 


2, 3, 4, 6, 9, 18 


(1st US to 3d US, already included m USYE ) 
(1st YE to 2d YE, already included in USYE ) 



m Are all these repetitions causal repetitions? It can be shown (Appendix 2, par 4e) that 
the odds against a theory that the USYE lepetition is accidental are about 99 to 1 (since the 
probability for its occurrence is 01) It can also be shown that the odds against a theory that the 
10 digraphs which occur two or more times are accidental repetitions are over 4 to 1 (Appendix 
2, par 5c), the odds against a theory that the two digraphs which occur 3 times are accidental 
repetitions aie quite large (Probability is calculated to be about 06 ) The chances are very 
great, therefore, that all or nearly all these repetitions are causal Certainly the chances agamst 
the two occurrences of the tctragraphUSYE and the three occurrencesof the two different digraphs 
(LE and US) being accidental are quite high, and it is therefore not astonishing that the intervals 
between all the various repetitions, except in one case, contain the factors 2 and 4. 

n. This means that if the cipher is written out in either 2 columns or 4 columns, all these 
repetitions (except the CX repetition) would fall into the same columns From this it follows 
that the length of the key is either 2 or 4, the latter, on practical grounds, being more probable 
than the former Doubts concerning the matter of choosing between a 2-letter and a 4-letter 
key will be dissolved when the cipher text is distributed into its component umlitcral frequency 
distributions 

o. The repeated digraph CX in the foregoing message is an accidental repetition, as will be 
apparent by referring to Fig 1 Had the message been longer there would have been more 
such accidental repetitions, but, on the other hand, there would be a proportionately greater 
number of causal repetitions. This is because the phenomenon of repetition in plain text is 
so all-pervading 

p. Sometimes it happens that the cryptanalyst quickly notes a repetition of a polygraph of 
four or more letters, the interval between the first and second occurrences of which has only 
two factors, of which one is a relatively small number, the other a relatively high incommen- 
surable number. He may therefore assume at once that the length of the key is equal to the 
smaller factor without searching for additional recurrences upon which to corroborate his 
assumption Suppose, for example, that in a relatively short cryptogram the interval between 
the first and second occurrences of a polygraph of five letters happens to be a number such as 
203, the factors of which are 7 and 29. Evidently the number of alphabets may at once be 
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assumed to be 7, unless one is dealing with messages exchanged among correspondents known 
to use long keys. In the latter case one could assume the number of alphabets to be 29. 

q. The foregoing method of determining the period in a polyalphabetic cipher is commonly 
referred to in the literature as “factoring the intervals between lepetitions”, or more often it is 
simply called “factoring ’’ Because the latter is an apt term and is brief, it will be employed 
hereafter in this text to designate the process 

10. General remarks on factoring . — a The statement made in Par 2 with respect to the 
cyclic phenomena said to be exhibited m cryptograms of the periodic type now becomes clear. 
The use of a short repeating key produces a periodicity of recurrences or repetitions collectively 
termed “cyclic phenomena”, an analysis of which leads to a determination of the length of the 
period or cycle, and this gives the length of the key. Only m the case of relatively short crypto- 
grams enciphered by a relatively long key does factoring fail to lead to the correct determination 
of the number of cipher alphabets in a repeating-key cipher, and of course, the fact that a crypto- 
gram contains repetitions whose factors show constancy is m itself an indication and test of its 
periodic nature It also follows that if the cryptogram is not a repeating-key cipher, then 
factoring will show no definite results, and conversely the fact that it does not yield definite 
results at once indicates that the cryptogram is not a periodic, repeating-key cipher. 

b There are two cases m which factoring leads to no definite results. One iB in the case of 
monoalphabetic substitution ciphers Here recurrences are very plentiful as a rule, and the 
intervals separating these recurrences may be factored, but the factors will show no constancy, 
there will be several factors common to many or most of the recurrences. This in itself is an 
indication of a monoalphabetic substitution cipher, if the very fact of the presence of many 
recurrences fails to impress itself upon the inexperienced cryptanalyst The other case in which 
the process of factoring is nonsignificant mvolves certam types of nonperiodic, polyalphabetic 
ciphers. In certam of these ciphers recurrences of digraphs, tngraphs, and even polygraphs 
may be plentiful m a long message, but the intervals between such recurrences bear no definite 
multiple relation to the length of the key, such as m the case of the true periodic, repeating-lcey 
cipher, in which the alphabets change with successive letters and repeat themselves over and 
over again 

c Factoring is not the only method of determining the length of the period of a periodic, 
polyalphabetic substitution cipher, although it is by far the most common and easily applied. 
At this point it will merely be stated that when the message under study is relatively short in 
comparison with the length of the key, so that there are only a few cycles of cipher text and no 
long repetitions affording a basis for factoring, there are several other methods available 
However, it being deemed inadvisable to interject the data concerning those other methods 
at this point, they will be explained subsequently. It is desirable at this juncture merely to 
indicate that methods other than factoring do exist and are used m practical work. 

d. Fundamentally, the factoring process is merely a more or less simple mathematical method 
of studying the phenomena of periodicity m cryptograms It will usually enable the crypt- 
analyst to ascertain definitely whether or not a given cryptogram is periodic in nature, and if 
so, the length of the period, stated m terms of the cryptographic unit involved By the latter 
statement is meant that the factoring process may be applied not only in analyzing the periodicity 
manifested by cryptograms in which the plain-text units subjected to cryptographic treatment 
are monographic in nature (l e are single letters) but also m studying the periodicity exhibited 
by those occasional cryptograms wherein the plain-text units are digraphic, trigraphic, or 
n-graphic in character. The student should bear this point m mind when he comes to the study 
of substitution systems of the latter sort. However, the present text will deal solely with cases 
of the former type, wherem the plain-text units subjected to cryptographic treatment are single 
letters. 
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11. Second step: distributing tbe cipher text into the component monoalphabets. — 0. 
After the number of cipher alphabets involved in the cryptogram has been ascertained, the next 
step is to rewrite the message in groups corresponding to the length of the key, or in columnar 
fashion, whichever is more convenient, and this automatically divides up the text so that the 
letters belonging to the same cipher alphabet occupy similar positions in the groups, or, if the 
columnar method is used, fall in the same column. The letters are thus allocated or distributed 
into the respective cipher alphabets to which they belong. This reduces the polyalphabetic 
text to monoalphabetic terms. 

b. Then separate unikteral frequency distributions for the thus isolated individual alphabets 
are compiled. For example, in the case of the cipher on page 13, having determined that four 
alphabets are involved, and having rewritten the message in four columns, a frequency distribu- 
tion is made of the letters in Column 1, another is made of the letters in Column 2, and so on for 
the rest of the columns. Each oj the resulting distributions is therefore a monoalphabetic frequency 
distribution. If these distributions do not give the characteristic irregular crest and trough 
appearance of monoalphabetic frequency distributions, then the analysis which led to the 
hypothesis as regards the number of alphabets involved is fallacious. In fact, the appearance of 
these individual distributions may be considered to be an index of the correctness of the factoring 
process; for theoretically, and practically, the individual distributions constructed upon the 
correct hypothesis will tend to conform more closely to the irregular crest and trough appearacne 
of a monoalphabetic frequency distribution than will the graphic tables constructed upon an 
incorrect hypothesis. These individual distributions may also be tested for monoalphabeticity 
by statistical methods. 

12. Third step: solving the monoalphabetic distributions. — The difficulty experienced in 

analyzing the individual or isolated frequency distributions depends mostly upon the type of 
cipher alphabets that is used. It is apparent that mixed alphabets may be used just as easily as 
standard alphabets, and, of course, the cipher letters themselves give no indication as to which 
is the case However, just as it was found that in the case of monoalphabetic substitution ciphers, 

a uniliteral frequency distribution gives clear indications as to whether the cipher alphabet is a 
standard or a mixed alphabet, by the relative positions and extensions of the crests and troughs 
in the table, so it is found that in the case of repeating-key ciphers, uniliteral frequency distribu- 
tions for the isolated or individual alphabets will also give clear indications as to whether these 
alphabets are standard alphabets or mixed alphabets. Only one or two such frequency distribu- 
tions are necessary for this determination; if they appear to be standard alphabets, similar distri- 
butions can be made for the rest of the alphabets, but if they appear to be mixed alphabets, then 
it is best to compile tnliteral frequency distributions for all the alphabets. The analysis of the 
values of the cipher letters in each table proceeds along the same lines as in the case of monoalpha- 
betic ciphers. The analysis is more difficult only because of the reduced size of the tables, but 
if the message be very long, then each frequency distribution will contain a sufficient number of 
elements to enable a speedy solution to be achieved. 



REF ID:A64560 



Section IV 

REPEATING-KEY SYSTEMS WITH STANDARD CIPHER ALPHABETS 

Parafraph 



Solution by applying principles of frequency. 13 

Solution by completing the plain-component sequence 14 

Solution by the "probable-word method" 15 



IS. Solution by applying principles of frequency. — a. In the light of the foregoing principles, 
let the following cryptogram be studied: 

Message 



A. 


A 


U K H Y 


JAMKI 


s 

Z Y M W M 


J M 


X G X 


N F M L 


X 


B. 


E 


T I M I 


Z H B H R 


A Y M Z M 


I L 


V M E_ 


J 


KUT 


G 


C. 


D 


P V X K 


QUKHQ 


L H V R M 


J A 


Z N G 


G 


z v_x 


E 


D. 


N 


L U F M 


P Z J N V 


CHUAS 


H K 


Q G K 


I 


P L ff 


P 


E. 


A 


J Z X I 


G U M T V 


D P T E J 


E C 


M Y S 


Q 


Y B A 


V 


F. 


A 


L A H Y 


P 0 E X ff 


P V N Y E 


E Y 


X E E 


U 


D P X 


R 


G. 


B 


V Z V I 


Z I I V 0 


S P T E G 


K U 


B B R 


Q 


L L X 


P 


H. 


ff 


F 0 G K 


N L L L E 


P T I K ff 


D J 


Z X I 


G 


0X0 


I 


J. 


z. 


L A M V 


K F_M ff F 


N P L Z I 


0 V V F M 


Z 


K T X 


G 


K. 


N L H D F 


A A E X I 


J L U F M 


P Z J N V 


C 


A X G 


I 


L. 


U A ff P R 


N V I W £_ 


J K Z A_S 


ZLAFH 


H 


S 





A search for repetitions discloses the following short lut with the intervals and factors 
above 10 omitted (for previous experience may lead to the conclusion that it is unlikely that the 
cryptogram involves more than 10 alphabets, showing the number of recurrences which it does): 



Repetition 


Location 


Interval 


Faeton 


LUSVPZJNVC 


Dl, K3 


160 


2, 4, 5, 8, 10. 

2, 3, 5, 6, 0, 10. 
5. 


.TZXTG 


El, H4 


00 


EJK ... 


B4, L2 


215 


PTE 


E3, G3 


50 


2, 5, 10. 
6. 


qt!K 


D4, HI 


86 


IIKH .. ... ... _. 


Al, C2 


55 


5. 


7.1k 


Jl, L4 


65 


5. 


AS ._ .... ... 


D3 , L3 


175 


3,6,7, 


EJ .. ... ... 


B4 LZ 


115 


5. 


Ell 


AS, Dl 


57 


8. 


Ell ... 


AS, J2 


mm 


5. 


W 


JZ , J4 


■rri 


2, 8, 4, 6. 
2, 4, 5, 10. 


ni 


J4, K3 




FIL 


KS , L4 


30 


2, 3, 6, 6, 10. 

2, 8, 4, 5, 6, 10. 
8, 5. 


JA _ ... 


A2, C4 


60 


IA 


FI, Jl 


75 


1 A 


Jl, L4 


66 


6. 


LL . .. 


G8, H2 


10 


2,5. 

8,6,7. 


ML ... 


Dl, H2 


mm 


WI. 


H2. K1 


Kl 


M,9. 


vx _ 


Cl. CS 




9. «. 5, 10. 
5. 




AS. B3 







( 17 ) 
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6. The factor 5 appears in all but two cases, each of which involves only a digraph. It seems 
almost certain that the number of alphabets is fivo Since the text already appears in groups of 
five letters, it is unnecessary to rewnte the message The next step is to make a uniliteral fre- 
quency distribution for Alphabet 1 to see if it can be determined whether or not standard alpha- 
bets are involved It is as follows 

Alphabet 1 

g v g % g ^ ^ 5 ^ gj __ g S: S: g 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

c. Although the indications are not very clear cut, yet if one takes into consideration the 
small amount of data the assumption of a direct standard alphabet with W„=A P , is worth further 
test Accordingly a similar distribution is made for Alphabet 2. 

Alphabet 2 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 

d There is every indication of a direct standard alphabet, with H e — A„ Let similar distri- 
butions be made for the last three alphabets They are as follows* 

Alphabet 3 



ABCDEFGH 



2 = 

I J 



K L 



UNO 



PQRSTUVWXYZ 



Alphabet 4 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 



Alphabet 5 

i = § 1.5 1 . = .15 g = = ^ 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

e After but little experiment it is found that the distributions can best be made to fit 
the normal when the following values are assumed. 

Alphabet 1 A P =W, 

Alphabet 2 A P =H„ 

Alphabet 3 A P =I, 

Alphabet 4 A„=T e 

Alphabet 5 A P =E, 

j. Note the key word given by the successive equivalents of A p * WHITE. The real proof of 
the correctness of the analysis is, of course, to test the values of the solved alphabets on the 
cryptogram. The five complete cipher alphabets are as follows: 



Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

1 WXYZABCDEFGHIJKLMNOPQRSTUV 

2 HIJKLMNOPQRSTUVWXYZABCDEFG 

Ciphers 3 IJKLMNOPQRSTUVWXYZABCDEFGH 

4 TUVWXYZABCDEFGHIJKLMNOPQRS 

,5 EFGHIJKLMNOPQRSTUVWXYZABCD 

IMna. 
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g. Applying these values to the first few groups of our message, the following is found: 

1 3 8 4 5 1 3 8 4 5 13345 12348 13848 

Cipher. AUKHY JAMKI ZYMWM JMIGX NFMLX. . . 

Plain. ENCOU NTERE DREDI NFANT RYEST... 

h. Intelligible text at once results, and the solution can now be completed very quickly. 
The complete message is as follows 

ENCOUNTERED RED INFANTRY ESTIMATED AT ONE REGIMENT AND MACHINE GUN COM- 
PANY IN TRUCKS NEAR EMMITSBURG. AM HOLDING MIDDLE CREEK NEAR HILL 543 SOUTH- 
WEST OF FAIRPLAY. WHEN FORCED BACK WILL CONTINUE DELAYING REDS AT MARSH 
CREEK. HAVE DESTROYED BRIDGES ON MIDDLE CREEK BETWEEN EMMITSBURG-TANEYTOWN 
ROAD AND RHODES MILL. 

i. In the foregoing example (which is typical of the system erroneously attributed, in cryp- 
tographic literature, to the French cryptographer Vigenere, although to do him justice, ho 
made no claim of having “invented” it), direct standard alphabets were used, but it is obvious 
that reversed standard alphabets may be used and the solution accomplished in the same 
manner. In fact, the now obsolete cipher disk used by the United States Army for a number 
of years yields exactly this type of cipher, which is also known in the literature as the Beaufort 
Cipher, and by other names In fitting the isolated frequency distributions to the normal, the 
direction of “reading” the crests and troughs is merely reversed. 

14. Solution by completing the plain-component sequence. — a. There is another method 
of solving this type of cipher, which is worthwhile explaining, because the underlying principles 
will be found useful in many cases. It is a modification of the method of solution by completing 
the plain-component sequence, already explained in Military Cryptanalysis, Port 1. 

b. After all, the individual alphabets of a cipher such as the one just solved are merely 
direct standard alphabets It has been seen that monoalphabetic ciphers in which standard 
cipher alphabets are employed may be Bolved almost mechanically by completing the plain- 
component sequence. The plain text reappears on only one generatrix and this generatrix is the 
same for the whole message. It is easy to pick this generatrix out of all the other generatrices 
because it is the only one which yields intelligible text. Ib it not apparent that if the same process 
is applied to the cipher letters of the individual alphabets of the ciphfer just solved that the plain- 
text equivalents of these letters must all reappear on one and the same generatrix? But how 
will the generatrix which actually contains the plain-text letters be distinguishable from the 
other generatrices, since these plain-text letters are not consecutive letters in the plain text but 
only letters separated from one another by a constant interval? The answer is Bimple The plain- 
text generatrix should be distinguishable from the others because it will show more and a better 
assortment of high-frequency letters, and can thus be selected by the eye from, the whole set of genera- 
trices. If this is done with all the alphabets in the cryptogram, it will merely be necessary to 
assemble the letters of the thus selected generatrices m proper order, and the result sould be 
consecutive letters forming intelligible text. 

c. An example will serve to make the process clear Let the same message be used as before. 
Factoring showed that it involves five alphabets. Let the first ten cipher letters in each alphabet 
be set down in a horizontal line and let the normal alphabet sequences be completed. Thus: 
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Aubabei 1 

1 AJZJNEZAIJ 

2 BKAKOFABJK 

3 CLBLPGBCKL 

4 DMCMQHCDLM 

5 ENDNRIDEMN 

6 FOEOSJEFNO 

7 GPFPTKFGOP 

8 HQGQULGHPQ 

9 IRHRVMHIQR 

10 JSISWNIJRS 

11 KTJTXOJKST 

12 LUKUYPKLTU 

13 MVLVZQLMUV 

14 NWMWARMNVW 

15 OXNXBSNOWX 

16 PYOYCTOPXY 

17 QZPZDUPQYZ 
IS RAQAEVQRZA 

19 SBRBFWRSAB 

20 TCSCGXSTBC 

21 UDTDHYTUCD 

22 VEUEIZUVDE 

23 WFVFJAVWEF 

24 XGWGKBWXFG 

25 YHXHLCXYGH 

26 ZIYIMDYZHI 



d. If the high-frequency generatrices underlined in Figure 3 are selected and their letters 
are juxtaposed in columns the consecutive letters of intelligible plain text immediately present 



themselves Thus: 

(For Alphabet 1, generatrix 5 ENDNRIDEMN 

For Alphabet 2, generatrix 20 NTRFYMARED 

Selected Generatrices* For Alphabet 3, generatrix 19 CEEAEATENM 

For Alphabet 4, generatrix 8 ORDNSTOGTA 

For Alphabet 5, generatrix 23 UEITTENIAC 



1 2 3 4 5 
'E N C 0 U 
N T E R E 
D R E D I 
N F A N T 

Columnar juxtaposition of letters R Y E S T 

from selected generatrices I M A T E 

D A T 0 N 
E R E G I 
M E N T A 
N D M A C 



Alphabet 2 Alphabet 8 Alphabet 4 Alphabet# 

UAYMFTHYLK KMMIMIBMVU HKWGLMHZMT YIMXXIRMEG 

VBZNGUIZML LNNJNJCNWV ILXHMNIANU ZJNYYJSNFH 



WCAOHVJANM M00K0KD0XW 
XDBPIWKBON NPPLPLEPYX 
YECQJXLCPO OQQMQMFQZY 
ZFDRKYMDQP PRRNRNGRAZ 
AGESLZNERQ QSSOSOHSBA 
BHFTMAOFSR RTTPTPITCB 
CIGUNBPGTS SUUQUQJUDC 
DJHVOCQHUT TVVRVRKVED 
EKIWPDRIVU UWWSWSLWFE 
FLJXQESJWV VXXTXTMXGF 
GMKYRFTKXW WYYUYUNYHG 
HNLZSGULYX XZZVZVOZIH 
IOMATHVMZY YAAWAWPAJI 
JPNBUIWNAZ ZBBXBXQBKJ 
KQOCVJXOBA ACCYCYRCLK 
LRPDWKYPCB BDDZDZSDML 
MSQEXLZQDC CEEAEATENM 
NTRFYMARED DFFBFBUFON 
OUSGZNBSFE EGGCGCVGPO 
PVTHAOCTGF FHHDHDWHQP 
QWUIBPDUHG GIIEIEXIRQ 
RXVJCQEVIH HJJFJFYJSR 
SYWKDRFWJI IKKGKGZKTS 
TZXLESGXXJ JLLHLHALUT 

Fiovbe S 



JMYINOJBOV AKOZZKTOGI 
KNZJOPKCPW BLPAALUPHJ 
LOAKPQLDQX CMQBBMVQIK 
MPBLQRMERY DNRCCNWRJL 
NQCMRSNFSZ EOSDDOXSKM 
ORDNSTOGTA FPTEEPYTLN 
PSEOTUPHUB GQUFFQZUMO 
QTFPUVQIVC HRVGGRAVNP 
RUGQVWRJWD ISCTHHSBWOQ 
SVHRWXSKXE JTXIITCXPR 
TWISXYTLYF KUYJJUDYQS 
UXJTYZUMZG LVZKKVEZRT 
VYKUZAVNAH MWALLWFASU 
WZLVABWOBI NXBMMXGBTV 
XAMWBCXPCJ OYCNNYHCUW 
YBNXCDYQDK PZDOOZIDVX 
ZCOYDEZREL QAEPPAJEWY 
ADPZEFASFM RBFQQBKFXZ 
BEQAFGBTGN SCGRRCLGYA 
CFRCGHCUHO TDHSSDMHZB 
DGSCHIDVIP UEITTENIAC 
EHTDIJEWJQ VFJUUFOJBD 
FIUEJKFXKR WGKWGPKCE 
GJVFKLGYLS XHLWWHQLDF 



VHCU4. 
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Plain text: ENCOUNTERED RED INFANTRY ESTIMATED AT ONE 
REGIMENT AND MAC ... . 

e. Solution by this method can thus be achieved without the compilation of any frequency 
tables whatever and is very quickly attained. The inexperienced cryptanalyst may have diffi- 
culty at first in selecting the generatrices which contain the most and the best assortment of 
high-frequency letters, but with increased practice, a high degree of proficiency is attained. 
After all it is only a matter of experiment, tnal, and error to select and assemble the proper 
generatrices so as to produce intelligible text. 

j. If the letters on the sliding strips were accompanied by numbers representing their relative 
frequencies in plain text, and these numbers were added across each generatrix, then that gen- 
eratrix with the highest total frequency would theoretically always be the plain-text generatrix. 
Practically it will be among the generatrices which show the first three or four greatest totals 
Thus, an entirely mathematical solution for this type of cipher may be applied. 

g. If the cipher alphabets are reversed standard alphabets, it is only necessary to convert 
the cipher letters of each isolated alphabet into their normal, plain-component equivalents and 
then proceed as in the cose of direct standard alphabets. 

A. It has been seen how the key word may be discovered in this type of cryptogram. Usually 
the key is made up of those letters in the successive alphabets whose equivalents are A p but other 
conventions are of course possible. Sometimes a key number is used, such os 8-4-7-1-12, 
which means merely that A„ is represented by the eighth letter from A (m the normal alphabet) 
in the first cipher alphabet, by the fourth letter from A m the second cipher alphabet, and so on. 
This modification is known in the literature as the Gronsfeld cipher However, the method of 
solution as illustrated above, being independent of the nature of the key, is the same as before. 

15. Solution by the "probable-word method .” — a The common use of key words m cryp- 
tograms such as the foregoing makes possible a method of solution that is simple and can be used 
where the more detailed method of analysis using frequency distributions or by completing the 
plain-component sequence is of no avail. In the case of a very short message which may show 
no recurrences and give no indications as to the number of alphabets involved, this modified 
method will be found most useful. 

6. Briefly, the method consists in assuming the presence of a probable word m the message, 
and referring to the alphabets to find the key letters applicable when this hypothetical word is 
assumed to be present in various positions in the cipher text. If the assumed word happens to 
be correct, and is placed in the correct position in the message, the key letters produced by 
referring to the alphabets will yield the key word. In the following example it is assumed that 
reversed standard alphabets are known to be used by the enemy. 

Mssbags 

MDSTJ LQCXC KZASA NYYKO LP 

c. Extraneous circumstances lead to the assumption of the presence of the word AMMU- 
NITION. One may assume that this word begins the message. Using sliding normal compo- 
nents, one reversed, the other direct, the key letters are ascertained by noting what the successive 
equivalents of A p are. Thus. 

Cipher. 

Plain text 

“Key” 



.... MDSTJLQCXC 

AMMUNITION 

.... MPENWTJKLP 
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The key does not spell any intelligible word. One therefore shifts the assumed word one letter 
forward and another trial is made. 

Cipher DSTJLQCXCK 

Plain text AMMUNITION 

“Key” DEFDYYVFQX 

This also yields no intelligible key word One continues to shift the assumed word forward 

one space at a time until the following point is reached 

Cipher LQCXCKZASA 

Plain text AMMUNITION 

“Key” LCORPSSIGN 

The key now becomes evident. It is a cyclic permutation of SIGNAL CORPS. It should be 
clear that since the key word or key phrase repeats itself during the encipherment of such a 
message, the plain-text word upon whose assumed presence in the message this test is being 
based may begin to be enciphered at any point in the key, and continue over into its next repeti- 
tion if it is longer than the key. When this is the case it is merely necessary to shift the latter 
part of the sequence of key letters to the first part, as m the case noted. LCORPSSIGN is trans- 
posed into SIGN . . LCORPS, and thus SIGNAL CORPS 

d. It will be seen m the foregoing method of solution that the length of the key is of no 
particular interest or consequence in the steps taken m effecting the solution. The determina- 
tion of the length and elements of the key comes after the solution rather than before it. In this 
case the length of the period is seen to be eleven, corresponding to the length of the key (SIGNAL 
CORPS). 

e. The foregoing method is one of the other methods of determining the length of the key 
(besides factoring), referred to in Par. 10c. 

j. If the assumption of reversed standard alphabets yields no good results, then direct 
standard alphabets are assumed and the test made exactly in the same manner. As will be 
shown subsequently, the method can also be used as a last resort when mixed alphabets are 
employed. 

g. When the assumed word is longer than the key, the sequence of recovered key letters will 
show a periodicity equal to the length of the key; that is, after a certain number of letters the 
sequence of key letters will repeat This phenomenon would be most useful in the case of keys 
that are not intelligible words but are composed of random letters or figures. Of course, if such 
a key is longer than the assumed word, this method is of no avail 

h This method of solution by searching for a word is contingent upon the following cir- 
cumstances: 

(1) That the word whose presence is assumed actually occurs in the message, is properly 
spelled, and correctly enciphered. 

(2) That the sliding components (or equivalent cipher disks or squares) employed in the 
search for the assumed word are actually the ones which were employed in the encipherment, 
or are such as to give identical results as the ones which were actually used. 

(3) That the pair of enciphering equations used in the test is actually the pair which was 
employed in the encipherment; or if a cipher square is used in the test, the method of finding 
equivalents gives results that correspond with those actually obtained in the encipherment. 
(See par. 9.) 
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t. The foregoing appears to be quite on array of contingencies and the student may think 
that on this account the method will often fail. But examining these contingencies one by one, 
it will be seen that successful application of the method may not be at all rare — after the solution 
of some messages has disclosed what sort of paraphernalia and methods of employing them are 
favored by the enemy. From the foregoing remark it is to be inferred that the probable-word 
method has its greatest usefulness not in an initial solution of a system, but only after successful 
study of enemy communications by more difficult processes of analysis has told its story to the 
alert cryptanalyst. Although it is commonly attributed to Bazenes, the French cryptanalyst 
of 1900, the probable-word method is very old in cryptanalysis and goes back several centuries. 
Its usefulness in practical work may best be indicated by quoting from a competent observer *. 

There is another [method] which is to this first method what the geometric method is to analysis in certain 
sciences, and, according to the whims of individuals, certain cryptanalysts prefer one to the other Certain others, 
incapable of getting the answer with one of the methods in the solution of a difficult problem, conquer it by means 
of the other, with a disconcerting masterly stroke This other method is that of tile probable word. We may 
have more or less definite opinions concerning the subject of the cryptogram We may know something about its 
date, and the correspondents, who may have been indiscreet in the subject they have treated On thiB basis, the 
hypothesis is made that a certain word probably appears in the text In certain classes of documents, 

military or diplomatic telegrams, banking and mining affairs, etc , it is not impossible to make very important 
assumptions about the presence of certain words in the text. After a cryptanalyst has worked for a long time 
with the writings of certain correspondents, he gets used to their expressions He gets a whole load of words 
to try out; then the changes of key, and sometimes of system, no longer throw into hiB way the difficulties of an 
absolutely new study, which might require the analytical method. 

To which I am prompted to add the amusing definition of cryptanalysis attributed to a 
British wag "All cryptanalysis is divided into two parts trance-titution and supposition." 

1 Givierge, M , Court de Cryptographs, Paris, 1925, p 30 
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Section V 

REPEATING-KEY SYSTEMS WITH MIXED CIPHER ALPHABETS, I 

Paragraph 



Reason for the use of mixed alphabets. 10 

Interrelated mixed alphabets 17 

Principles of direct symmetry of position ! 18 

Initial steps in the solution of a typical example. 19 

Application of principles of direct symmetry of position 20 

Subsequent steps m solution „ 21 

Completing the solution 22 

Solution of subsequent messages enciphered by same cipher component 23 

Summation of relative frequencies as an aid to the selection of the correct generatrices 24 

Solution by the probable-word method 25 

Solution when plain component Is mixed, the cipher component, the normal 26 



16. Season for the use of mixed alphabets . — a It has been seen in the examples considered 
thus for that the use of several alphabets in the same message does not greatly complicate the 
analysis of such a cryptogram. There are three reasons why this is so. Firstly, only relatively 
few alphabets were employed; secondly, these alphabets were employed in a periodic or repeating 
manner, giving rise to cyclic phenomena in the ciyptogram, by means of which the number of 
alphabets could be determined; and, thirdly, the cipher alphabets were known alphabets, by 
which is meant merely that the sequences of letters in both components of the cipher alphabets 
were known sequences. 

b. In the case of monoalphabetic ciphers it was found that the use of a mixed alphabet 
delayed the solution to a considerable degree, and it will now be seen that the use of mixed alpha- 
bets in polyalphabetic ciphers renders the analysis much more difficult than the use of standard 
alphabets, but the solution is still fairly easy to achieve. 

17. Interrelated mixed alphabets. — a. It was stated in Par. 5 that the method of producing 
the mixed alphabets in a polyalphabetic cipher often affords clues which are of great assistance 
in the analysis of the cipher alphabets. This is so, of course, only when the cipher alphabets 
are interrelated secondary alphabets produced by sliding components or their equivalents. 
Reference is now made to the classification set forth in Par. 6, in connection with the types of 
alphabets which may be employed in polyalphabetic substitution. It will be seen that thus far 
only Cases A (1) and (2) have been treated. Case B (1) will now be discussed. 

b. Here one of the components, the plain component, is the normal sequence, while the 
cipher component is a mixed sequence, the various juxtapositions of the two components yielding 
mixed alphabets. The mixed component may be a systematically-mixed or a random-mixed 
sequence. If the 25 successive displacements of the mixed component are recorded in separate 
lines, a symmetrical cipher square such as that shown in Fig. 5 results therefrom. It is identical 
in form with the square table shown on p. 7, labeled Table I-A. 

( 24 ) 
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ABCDEFGHIJKLMNOPQRSTUVWXYZ 
LEAVNWORTHBCDFGIJKMPQSUXYZ 
EAVNWORTHBCDFGIJKMPQSUXYZL 
AVNVORTHBCDFGIJKMPQSUXYZLE 
VNWORTHBCDFGIJKMPQSUXYZLEA 
NWORTHBCDFGIJKMPQSUXYZLEAV 
WORTHBCDFGIJKMPQSUXYZLEAVN 
ORTHBCDFGI JKUPQSUXYZLGAVNW 
RTHBCDFGIJKMPQSUXYZLEAVNWO 
THBCDFGIJKMPQSUXYZLEAVNWOR 
HBCDFGIJKMPQSUXYZLEAVNWORT 
BCOFGI JKHPQSUXYZLEA VNRORTH 
CDFGIJKMPQSUXYZLEAVNffORTHB 
DFGIJKMPQSUXYZLEAVNWORTHBC 
FGIJKMPQSUXYZLEAVNWORTHBCD 
GIJKMPQSUXYZLEAVNWORTHBCDF 
IJKMPQSUXYZLEAVNWORTHBCDFG 
JKMPQSUXYZLEA VNWORTHBCDFGI 
KKPQSUXYZLEAVNf ORTHBCDFGI J 
MPQSUXYZLEAVNWORTHBCDFGIJK 
PQSUXYZLEAVNWORTHBCDFGIJKM 
QSUXYZLEAVNWORTHBCDFGIJKMP 
SUXYZLEAVNWORTHBCDFGIJKMPQ 
UXYZLEAVHVORTHBCDFGI JKHPQS 
XYZLEAVNWORTHBCDFGIJKMPQSU 
YZLEAVNWORTHBCDFGIJKMPQSUX 
ZLEAVNWORTHBCDFGIJKMPQSUXY 

Florae (. 

- c. Such a cipher square may be used in exactly the same manner as the Vigenere square. 

With the key word BLUE and conforming to the normal enciphering equations (8 k /*=9i/i; 9p/i= 
8,/j), the following lines of the square would be used: 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 
BCDFGIJKMPQSUXYZLEAVN WORTH 
LEAVNWORTHBCDFGIJKMPQSUXYZ 
UXYZLEAVNWORTHBCDFGI JKHPQS 
EAVNWORTHBCDFGIJKMPQSUXYZL 

Florae Si 

These lines would, of course, yield the following cipher alphabets: 

| m Flam... ABCDEFGHIJKLMNOPQRSTUVWXYZ 

j Cipher. BCDFGIJKMPQSUXYZLEAVNWORTH 

| Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

W Cipher. LEAVNWORTHBCDFGIJKMPQSUXYZ 

... Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

W Cipher. UXYZLEAVNWORTHBCDFGIJKMPQS 

... Plain. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

W Cipher. EAVNWORTHBCDFGIJKMPQSUXYZL 

Florae at. 



Plain., 



Cipher. 



I 
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18. Principles of direct symmetry of position. — a. It was stated directly above that Fig. 5 
is a symmetrical cipher square, by which is meant that the letters in its successive horizontal 
lines show a symmetry of position with respect to one another. They constitute, in reality, one 
and only one sequence or series of letters, the sequences being merely displaced successively 1, 
2, 3, . . . intervals. The symmetry exhibited is obvious and is said to be visible, or direct. 
This fact can be used to good advantage, as has already been alluded to in par. 7j. 

6. Consider, for example, the pair of letters G s and V ( in cipher alphabet (1) of Fig. 66. The 
letter V, is the 15th letter to the right of G*. In cipher alphabet (2), V, is also the 15th letter to 
the right of G a , as is the case in each of the four cipher alphabets in Fig. 66, Bince the relative 
positions they occupy are the same in each horizontal line in Fig. 6a, that ib, in each of the suc- 
cessive recordings of the cipher component as the latter is slid to the right against the plain or 
normal component If, therefore, the relative positions occupied by two letters, 9, and 0 a , in 
such a cipher alphabet, Ci, are known, and if the position of 9| in another cipher alphabet, C*, 
belonging to the same series is known, then 9 a may at once be placed into its correct position in C*. 
Suppose, for example, that as the result of an analysis based upon considerations of frequency, 
the following values in four cipher alphabets have been tentatively determined: 

Plain.. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

{1) Cipher. G Y V 

. Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

W Cipher. N G P 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

C3) Cipher. L B I 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

W Cipher W IQ 

nocBl 7a 



c. The cipher components of these four secondary alphabets may, for convenience, be assem- 
bled into a cellular structure, hereinafter called a sequence reconstruction skeleton, as shown in 
Fig. 76. Regarding the top line of the reconstruction skeleton in Fig 76 as being c ommo n to all 
four secondary cipher alphabets listed m Fig. 7a, the successive lines of the reconstruction skeleton 
may now be termed cipher alphabets, and may be referred to by the numbers at the left 




d. The letter G is common to Alphabets 1 and 2. In Alphabet 2 it is noted that N occupies 
the 10th position to the left of G, and the letter P occupies the 5th position to the right of G. 
One may therefore place these letters, N and P, in their proper positions in Alphabet 1, the letter N 
being placed 10 letters before G, and the letter P, 5 letters after G Thus. 



Plain. 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


1 










G 










P 










Y 










_V^ 


N 













t 
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Thus, the values of two new letters in Alphabet 1, viz, P«=J p , and N 0 =U„ have been automati- 
cally determined; these values were obtained without any analysis based upon the frequency of 
P a and N e . Likewise, in Alphabet 2, the letters Y and V may be inserted in these positions 



Plain 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


w 


X 


Y 


Z 


2 









V 


N 





















G 










P 










Y 





This gives the new values V„=D P and Y a =Y p in Alphabet 2. Alphabets 3 and 4 have a common 
letter I, which permits of the placement of Q and V in Alphabet 3, and of B and L in Alphabet 4 

e. The new values thus found are of course immediately inserted throughout the crypto- 
gram, thus leading to the assumption of further values in the cipher text This process, viz, the 
reconstruction of the primary components, by the application of the principles of direct symmetry 
of position to the cells of the reconstruction skeleton, thus facilitates and hastens solution. 

/. It must be clearly understood that before the principles of direct symmetry of position 
can be applied in cases such as the foregoing, it is necessary that the plain component be a known 
sequence. Whether it is the normal sequence or not is immaterial, so long as the sequence is 
known. Obviously, if the sequence is unknown, symmetry, even if present, cannot be detected 
by the cryptanalyst because he has no base upon which to try out his assumptions for 
symmetry. In other words, direct symmetry of position is manifested m the illustrative 
example because the plain component is a known sequence, and not because it is the 
normal alphabet. The significance of this point will become apparent later on m connection 
with the problem discussed in Par. 266 

19. Initial steps in the solution of a typical example . — a In the light of the foregoing prin- 
ciples let a typical message now be studied. 



Message 



A. 


i 

0 W B R I 


a 

V ff Y C A 


i 

I S P J L 


R 


4 

B Z E 


Y 


5 

Q W Y E U 


B. 


L 


ff M G ff 


I 


_c 


J C I 


M T Z E I 


M 


I B K 


N 


0 ff B R 


x 


C. 


V W Y I G 


B 


w 


NBQ 


Q C G Q H 


I 


W J K_ 


A 


G E 


G 


X 


N 


D. 


I 


D M R U 


V 


E 


Z Y G 


Q I G V N 


C 


T G Y 


0 


B P 


D 


B 


L 


E. 


V 


C G X G 




K 


Z Z G 


JVXCU 


N 


T Z A 


0 


B W 


F 


E 


Q 


F. 


Q 


L F C 0 


U 


T 


Y Z T 


C C B Y Q 


0 


PDK 


A 


G D 


G 


I 


G 


G. 


V 


P W M R 


Q 


I 


I E ff 


I C G X G 


B 


LGQQ 


V B 


G 


R 


S 


H. 


M 


Y J J Y 


Q 


V 


F ff Y 


R ff N F L 


G 


X N F 


W 


M C 


J 


K 


X 


J. 


I 


D D R U 


0 


P 


J Q Q 


Z R H C N 


V 


W D Y Q 


R D 


G 


D 


G 


K. 


B 


X D B N 


P 


X 


FPU 


Y X N F G 


M 


P J E 


_L 


S A 


N 


C 


D 


L. 


S 


E Z Z G 


I 


B 


E Y U 


KDHCA 


M 


B J J 


F 


K I 


L 


C 


J 


M. 


U 


F D Z T 


_C 


T 


J R D 


M I Y Z Q 


A 


C J R R 


S B 


G 


Z 


N 


N. 


Q 


Y A H Q 


V 


E 


D C Q 


L X N C L 


L 


V V C 


S 


Q ff 


_B 


I 


I 


P. 


I 


V J R N 


ff 


N 


B R I 


V P J E L 


T 


A G D 


N 


I R G 


Q 


P 


Q. 


A 


T Y E W 


c 


B 


Y Z T 


E V G Q U 


V 


P Y H 


L 


L R 


Z 


N 


Q 


R. 


X 


I N B A 


I 


K 


w J L 


R D Z Y F 


K 


W F Z 


L 


G V 


F 


J 


Q 


S. 


Q 


V J Y Q 


I 


B 


ff R X 
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^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ 

ABCDEFGHI JKLMN OPQRS TDVff X YZ 

Roou 8. 

c. Attempts to fit this distribution to the normal on the basis of a direct or reversed standard 
alphabet do not give positive results, and it is assumed that mixed alphabets are involved. 
Individual triliteral frequency distributions are then compiled and are shown in Fig. 9. These 
tables are similar to those made for single mixed alphabet ciphers, and are made in the same 
way except that instead of taking the letters one after the other, the letters which belong to the 
separate alphabets now must be assembled in separate tables. For example, in Alphabet 1, 
the trigraph QAC means that A occurs in Alphabet 1 ; Q, its prefix, occurs in Alphabet 5, and C, its 

suffix, occurs in Alphabet 2. All confusion may be avoided by placing numbers indicating the 

1 1 2 

alphabets in which they belong above the letters, thus- QAC 



Alphabet 1 



A B C D 


E F G 


H I J 


K L II N 


0 P Q R S T 


U V W X Y Z 


QC GW NT 


TV AE 


AS 


UDUWZTUTQPNX-WLBLALA 


IW NN QI UX QR 


PT OP TC 


AD 


wc 


FI QX II 


UP VW YW DE 


IW 


GK« 


LX 


HW 


PW LV OT 


NW QD RB 


UE 


OW WB 


LW 


ND 


LR ST 


QC QD 


LC 


GL 




GV 


WC 


Cl 


GP 


GX 




WC 


GP 


QL 


QB 






XD 


AB 


RI 


NW 






GB 


JF 


YV 


QE 






IV 


DI 


NY 


IP 






NR 




SW 


UP 






AK 




QW 








09 
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Alphabet 2 



ABC 


D E F G 


H I J K L 


M K 


0 P 


Q R 


S T U 


V ff X Y 


SN RZ IJ 


XM GG MD 


MB Iff QF 


WB 


BD 


ZH IP MZ 


IX QB GN MJ 


TG VG QG 


GG VZ 


QG BZ BG 




OD 


IG 


CG 


QF VY BD QA 


IE VG 


ID SZ 


QI 




Vff 


LZ 


NZ 


LV QY PF 


MJ CB 


RG VD 


KL 




OJ 




MY 


IJ LM YN 


SG IG 


KH 


MY 




MJ 




CJ 


EG QB LN 


CT MJ 


RZ 


XN 




VJ 




AY 


VY 


Iff AJ 








VY 






BN 



IJ 

BF 

RN 

VD 

QB 

KF 

GF 

QJ 



Alphabet 3 



ABCDEFGHIJKLMNO 



PQRSTUVWXYZ 



yh m 


PB BY ffE CQ RC 


IE CC 


IC WG WB SJ 


VC PM VC ffC BE 


IK 


PK 


LC EX DC 


WK 


DR ffF 


KJ WE TE 


wr 


DR 


Vff IV 


YJ 


XF 


BR VI EY 


CY 


ffY 


XP TY 


CK 


XF 


TZ KZ 


ffl 


XB 


ffZ CX 


PQ 


AC 


IZ TA 


NR 


FZ 


ff J DI 


PE 


XC 


TE EZ 




EC 


CX 


BJ 


IB 


BZ RN 






LQ 


TR 




PH DY 






BR 


CR 










DD 


VR 










BZ 


PE 










AD 


WY 







RQ 

VQ 

Alphabet 4 

ABCDEFGHIJKLMNOPQRSTUVffXYZ 



ZO NQ YA GG ZY NL Mff 


AQ YG PL BN 


ffR ZQ 


FU GH BI 


GN FY GN ZG ZG 


DL JI GN YU Nff 


YL GG JY JA 




GQ BI 


GG GO YT 


DN XU 


ZI NG 


BI JF DA 




JQ MU 


GG BQ ZG 


NA FO 


FQ 


ffQ JX 




GP GS 


DQ DT 


HN 


Iff 


FQ 




GU DU 


EU YQ 


ND 


JL 






JD 


ZF GN 


HA 


JL 






JR 


JQ YT 


U 


Yff 






JN 


FL 


DQ 








BI 




NL 








ffX 





VS 

9179T4 O - 41 - 9 
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Alphabet 5 



A B 


C D 


E F G 


H I J 


KLMNOPQR 


S T U V 


ff 


X Y Z 




CZ 


CS 


JK IB QI RV CM 


JR 


KQ YB QA BQ MQ RM ZC EL 


GI KI EQ 




KG 


RM 


YK YQ 


CM 


BV 


XI AB EQ RS CQ ZC RV 


El 


R- JQ 




KG 




XB 


EM 


FG 


VC CM YO 


ZE CN 


FH 


WR 




CM 




ZI 


RV 


ES 


CV QV 


RO 


EC 






BI 




IV 


II 


CL 


BP QZ 


PY 






ff 






XB 


RV 


ET 


ZQ YR 


YK 












DB 




HL 


RW ZA 


QV 












FM 




ZG 


DI HV 














ZI 






CL 











NX 

JR 

JQ 

YI 



1-2-3— 4-5-1-2-3 


Condented table of repetitions 
1-2-3 


1-2 


Q W B R I V ff Y-2 


Q W B-3 


Q ff-5 




V ff Y-2 


V P-3 


2-3— 4-5-1 




V ff-3 


C G X G B-2 


2-3-4 






C G X-2 


2-3 


2-3— 4-1 


P J E-2 


C G-3 


P J E L-2 


ff B R— 2 


C J-3 




X N F-2 


P J-3 


3— 4-5-1 




W B-3 


B-R-I-V 


3-4-5 


W F-3 


Z-Z-G-I— 2 


B R 1-3 


ff Y-3 




G X G-2 


X N-3 




J E L-2 
Y Z T-2 


3-4 




Z Z G-2 


B R— 3 




4-5-1 


G Q— 4 
G X-3 




K A G-2 


J R-3 




X G B-2 


N F-3 




Z G 1-2 


Y Z-3 




ZTC-2 
R I V-3 


4-5 




5-1-2 


R 1-3 
Y G-3 




I V ff-2 


Z T-3 




QRD-2 
ff I C-2 


5-1 






G B— 4 
I V-3 
Q Q-3 



Fioubi 9 
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d. One now proceeds to analyze each alphabet distribution, in an endeavor to establish 
identifications of cipher equivalents First, of course, attempts should be made to separate 
the vowels from the consonants in each alphabet, using the same test as in the case of a single 
mixed-alphabet cipher. There seems to be no doubt about the equivalent of Ep in each alphabet: 

1 a s 4 s 
E=I a , W, , G a , C, , Q, 

e. The letters of greatest frequency in Alphabet 1 are I, M, Q, V, B, G, L, R, S, and C. I, 

2 6 

has already been assumed to be Ep. If V, and Q*=Ep, then one should be able to distinguish the 

vowels from the consonants among the letters M, Q, V, B, G, L, R, S, and C by examining the 
2 6 

prefixes of W„ and the suffixes of Q a . The prefixes and suffixes of these letters, as shown by the 
triliteral frequency distributions, are these: 



a a 

Prefixes of V. (=Ep) 



a a 

Suffixes of Q, (=Ep) 



QGKVRBIL 



IQRXLVAZO 



i a a 

f. Consider now the letter M a ; it does not occur either as a prefix of W a , or as a s uffix of Qe. 

Hence it is most probably a vowel, and on account of its high frequency it may be assumed to 

i a 

be Op. On the other hand, note that Q, occurs five times as a prefix of ff 0 and three times as 

a suffix of Q,. It is therefore a consonant, moBt probably R-, for it would give the digraph 
si la 

ER (=QQa) as occurring three times and RE (=QW„) as occurring five times. 

x as 

g. The letter V 0 occurs three times as a prefix of ff 0 and twice as a suffix of Q«. It is there* 

i 

fore a consonant, and on account of its frequency, let it be assumed to be T p . The letter B, 

a s 

occurs twice as a prefix of W a but not as a suffix of Q a . Its frequency is only medium, and it is 

i a 

probably a consonant. In fact, the twice repeated digraph BW a is once a part of the trigraph 
sia s' 

GBW, and G e , the letter of second highest frequency in Alphabet 5, looks excellent for T # . Might 
si a 

not the tngraph GBV be THE? It will be well to keep this possibility in mind. 

1 a s 

h The letter G.occutb only once as a prefix of W a and does not occur as a suffix of Q a . It may 

i a 

be a vowel, but one can not be sure. The letter L a occurs once as a prefix of ff a and once as a 
s i a 

suffix of Q a It may be considered to be a consonant R a occurs once as a prefix of W a , and twice 
8 11 
as a suffix of Q a , and is certainly a consonant Neither the letter S. nor the letter C a occurs as a 
a s 

prefix of V a or as a suffix of Q a , both would seem to be vowels, but a study of the prefixes and 

i i 

suffixes of these lettero lends more weight to the assumption that C a is a vowel than that S a is a 

s s s 

vowel. For all the prefixes of C, viz, N, T, and V, are in subsequent analysis of Alphabet 5 classi- 
fied as consonants, as are likewise its suffixes, viz, T, C, and B in Alphabet 2. On the other hand, 
s a i 

only one prefix, L a , and one suffix, B a , of S a are later classified as consonants. Since vowels are 
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i 

more often associated with consonants than with other vowels, it would seem that C 0 is more 

11 i 

likely to be a vowel than S,. At any rate C« is assumed to be a vowel, for the present, leaving S ( 

unclassified. 

t. Going through the same steps with the remaining alphabets, the following results are 
obtained: 



Alphabet 


Consonants 


Vowel* 


1 


Q, V, B, L. R, G? 


I, M» C. 


2 


B. C, D, T. 


W. P, X. 


3 


J. H, D, Y» P. 


G. Z. 


4 


Y, Z, J. Q. 


C, E7, R?, B? 


5 


G. H. A, X, V. L. T. 


Q. U. 



20. Application of principles of direct symmetry of position. — a. The next step is to try 
to determine a few values in each alphabet. In Alphabet 1, from the foregoing analysis, the 
following data are on hand: 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher C? I C? M Q V 



Let the values of E, already assumed in the remaining alphabets, be set down in a reconstruction 
skeleton, as follows: 



Plain.. 


... 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


H 


N 


0 


P 


_Q 


R 


s 


T 


U 


V 


W 


X 


Y 


Z 




1 


C? 








I 








C? 












M 






Q 




V 
















2 










V 












































Cipher 


3 „ 










G 














































4 










C 














































5 










Q 













































noiuii 



6 It is seen that by good fortune the letter Q is common to Alphabets 1 and 5, and the 
letter C is common to Alphabets 1 and 4 If it is assumed that one is dealing with a case in which 
a mixed component is sliding against the normal component, one can apply the principles of 
direct symmetry of position to these alphabets, as outlined in Par. 18. For example, one may 
insert the following values in Alphabet 5: 



Plain 

Cipher| 



A 


B 


c 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


_Q 


R 


s 


T 


U 


V 


W 


X 


Y 


Z 


C? 








I 








C? 












H 






Q 




V 
















U 






Q 




V 














C? 








I 








C? 











FiopbbU. 
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< t s 

e. The process at once gives three definite values: lf«=Bp, V,=G„, I ( =Rp. Let these de- 
duced values be substantiated by referring to the frequency distribution. Since B and 6 are 
normally low or medium frequency letters in plain text, one should find that H, and V„ their 
hypothetical equivalents in Alphabet 5, should have low frequencies. As a matter of fact, they 

do not appear in this alphabet, which thus far corroborates the assumption. On the other hand, 
s f 

since I«=Rp, if the values derived from symmetry of position are correct, I, should be of high 
frequency, and reference to the distribution shows that I, is of high frequency. The position of 
C is doubtful; it belongs either under N p or V p . If the former is correct, then the frequency 

5 

of C, should be high, for it would equal N p ; if the latter is correct, then its frequency should be 

6 

low, for it would equal V e . As a matter of fact, C e does not occur, and it must be concluded 

i 

that it belongs under V p . This in turn settles the value of C„ for it must now be placed definitely 
under I p and removed from beneath A,. 

d. The definite placement of C now permits the insertion of new values in Alphabet 4, and 
one now has the following: 




21. Subsequent steps in solution. — a. It is high time that the thus far deduced values, as 
recorded in the reconstruction skeleton, be inserted in the cipher text, for by this time it must seem 
that the analysis has certainly gone too far upon unproved hypotheses. The following results 
are obtained: 

Message 





i 


* 


i 


4 


B 


A. 


Q W B R I 
RE R 


V W Y C A 
T E E 


I S P J L 
E 


R B Z E Y 


Q W Y E U 
R E 


B. 


L Wit G V 


I C J C I 


HTZEI 


HI6KN 


QWBRI 




E 


E E R 


0 R 


0 


RE R 


C. 


V W Y I G 


BRHBQ 


Q C G Q H 


I W J K A 


GEGZK 
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D. 


IDURU 


V E Z Y G 


Q I G V N 


C T G Y 0 


B P D B L 




E 


T 


R E P 


I E 




E. 


V C G X G 


B K Z Z G 


I V X C U 


N T Z A 0 


BVFEQ 




T E 




E E 




E E 


F. 


Q L F,C 0 


HTYZT 


CCBYQ 


0 P D K A 


G D G I G 




R E 


0 


I E 




E A 


G. 


V P W M R 


Q I I E W 


I C G X G 


B L G Q Q 


V B G R S 




T K 


R 


E E 


E N E 


T E 


H. 


M Y J J Y 


Q V F W Y 


R V N F L 


G X N F ff 


HCJKX 




0 


R 


E 




0 


J. 


I D D R U 


OPJQQ 


Z R H C N 


V W D Y Q 


R D G D G 




E 


N E 


E 


T E E 


E 


K. 


B X D B N 


P X F P U 


Y X N F G 


HPJEL 


S A N C D 










0 


E 


L. 


S E Z Z G 


I B E Y U 


K 0 H C A 


liBJJF 


K I L C J 






E 


E 


0 


E 


M. 


HFDZT 


C T J R D 


IIYZQ 


A C J R R 


S B G Z N 




0 


I 


0 E 




E 


N. 


Q Y A H Q 


V E D C Q 


L X N C L 


L V V C S 


Q V B I I 




R E 


T EE 


E 


E 


RE A R 


P. 


I V J R N 


VNBRI 


V P J E L 


T A G D N 


IRGQP 




E 


R 


T 


E 


E E N 


Q. 


A T Y E W 


C B Y Z T 


E V G Q U 


V P Y H L 


L R Z N Q 






I 


E N 


T 


E 


R. 


X I N B A 


I K W J Q 


R D Z Y F 


K W F Z L 


G V F J Q 






E E 




E 


E E 


S. 


Q W J Y Q 


I B W R X 










RE E 


E 
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b. The combinations given are excellent throughout and no inconsistencies appear. Note 
123 

the trigraph QWB, which is repeated in the following polygraphs (underlined in the foregoing text) : 

121421 2122421 

QWBRIV. . . S Q V B I I I 

RE RT... RE ARE 

i 

e. The letter B„ is common to both polygraphs, and a little imagination will lead to the 

3 

assumption of the value B e =P p , yielding the following: 

121421 2123421 

QWBRIV. . .SQWBIII 

REPORT. . .PREPARE 

4 2 1 2 3 4 

d. Note also (in F5) the polygraph I G V P If II, which looks like the word ATTACK. The 

AT K 

2 2 

frequency distributions are consulted to see whether the frequencies given for G 0 and P, are high 

3 

enough for T p and A p , respectively, and also whether the frequency of W 0 is good enough for C p ; 

21 

it is noted that they are excellent Moreover, the digraph GB e , which occurs four times, looks 

i 

like TH, thus making B,=H P . Does the insertion of these four new values in our diagram of 

2 1 

alphabets bring forth any inconsistencies? The insertion of the value P„=A p and B.=H P gives 

no indications either way, since neither letter has yet been located in any of the other alphabets. 

2 

The insertion of the value G e =T p gives a value common to Alphabets 3 and 5, for the value 
s 

G 0 =E p was assumed long ago. Unfortunately an inconsistency is found here. The letter I 
has been placed two letters to the left of G in the mixed component, and has given good results 

i 

in Alphabets 1 and 5; if the value W,=C P (obtained above from the assumption of the word 
ATTACK) is correct, then W, and not I, should be the second letter to the left of G. Which shall 

3 

be retained? There has been so far nothing to establish the value of G„=E P ; this value was 
assumed from frequency considerations solely Perhaps it is wrong It certainly behaves like 
a vowel, and one may see what happens when one charges its value to 0 P The following 
placements in the reconstruction skeleton result from the analysis, when only two or three new 
values have been added as a result of the clues afforded by the deductions: 



Plain... 
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t Many new values are produced, and these are inserted throughout the message, yielding 
the following: 







1 






2 










3 










4 










5 
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22. Completing the solution. — a. Completion of solution is now a very easy matter. 
The mixed component is finally found to be the following sequence, based upon the word 
EXHAUSTING: 

EXHAUSTINGBCDFJKLMOPQRVWYZ 
and the completely reconstructed skeleton of the cipher square is shown in Fig 136 

Plain. 

1 

2 . 

Cipher...' 3 

4 

.5 



b. Note that the successive equivalents of A p spell the word APRIL, which is the key for the 
message. The plain-text message is as follows* 

REPORTED ENEMY HAS RETIRED TO NEWCHESTER. ONE TROOP IS REPORTED AT HEN- 
DERSON MEETING HOUSE: TWO OTHER TROOPS IN ORCHARD AT SOUTHWEST EDGE OF NEW- 
CHESTER. 2D SQ IS PREPARING TO ATTACK FROM THE SOUTH. ONE TROOP OF 3D SQ IS 
ENGAGING HOSTILE TROOP AT NEWCHESTER. REST OF 3D SQ IS MOVING TO ATTACK 
NEWCHESTER FROM THE NORTH. MOVE YOUR SQ INTO WOODS EAST OF CROSSROAD 539 AND 
BE PREPARED TO SUPPORT ATTACK OF 2D AND 3D SQ . DO NOT ADVANCE BEYOND NEWCHESTER . 
MESSAGES HERE. 

TREER. 

COL. 

c The preceding case is a good example of the value of the principles of direct symmetry 
of position when applied properly to a cryptogram enciphered by the sliding of a mixed com- 
ponent against the normal. The cryptanalyst starts off with only a very limited number of 
assumptions and builds up many new values as a result of the placement of the few original 
values in the reconstruction skeleton. 

23. Solution of subsequent messages enciphered by the same cipher component. — a. 
Preliminary remarks . — Let it be supposed that the correspondents are using the same basic or 
primary component but with different key words for other messages. Can the knowledge of 
the sequence of letters in the reconstructed primary component be used to solve the subsequent 
messages? It has been shown that in the case of a monoalphabetic cipher in which a mixed 
alphabet was used, the process of completing the plain component could be applied to solve 
subsequent messages in which the same cipher component was used, even though the cipher 
component was set at a different key letter. A modification of the procedure used in that case 
can be used in this case, where a plurality of cipher alphabets based upon a sliding primary 
component is used. 




Flam 136 





REF ID:A64560 



38 



b. The message . — Let it be supposed that the following message passing between the same 
two correspondents as in the preceding message has been intercepted: 

Mebsaoe 



SFDZR 


YRRKX 


MIWLL 


AQRLU 


RQFRT 


IJQKF 


XUWBS 


MDJZK 


MICQC 


UDPTV 


TYRNH 


TRORV 


BQLTI 


QBNPR 


RTUHD 


PTIVE 


RMGQN 


LRATQ 


PLUKR 


KGRZF 


JCMGP 


IHSMR 


GQRFX 


BCABA 


OEMTL 


PCXJM 


RGQSZ 


VB 











c. Factoring and conversion into plain component equivalents — The presence of a repetition 
of a four-letter polygraph whose interval is 21 letters suggests a key word of seven letters There 
are very few other repetitions, and this is to be expected in a short message with a key of such 



length. 
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B 







d. Transcription into periods. — Let the message 
be written in groups of seven letters, in columnar 
fashion, as shown in Fig 14. The letters in each 
column belong to a single alphabet. Let the letters 
in each column be converted into their plain-com- 
ponent equivalents by setting the reconstructed 
cipher component against the normal alphabet at any 
arbitrarily selected point, for example, that shown 
below. 



1 > I 4 5 « 7 

FNiiznr 

V P B R H X Q 
Q D U V Q E V 
U N V G H 0 U 
P N B E X K F 
R M 0 Z P R H 
LULEHTG 
W G Y V I C G 

V S V W K U Q 
G H U K I T V 

V G E C M T G 
H W A V R J U 
IftVDGUT 
Q E P V P J V 
Z N 0 L R J T 
H C F R V J U 

V N B K L D K 
D S A R G Q T 
L B 0 R V J U 
F Z W K 



FjOUXX 14 



Figure U 



Plain ABCDEFGHIJKLMNOPJQRSTUVVXYZ 

Cipher EXHAUSTINGBCDFJKLMOPQRVWYZ 

The columns of equivalents are now as shown in Fig. 15. ... 

e Examination and selection of generatrices. — It has been shown that in the case of a mono- 
alphabetic cipher it was merely necessary to complete the normal alphabet sequence 'beneath 
the plain-component equivalents and the plain text all reappeared on one generatrix. It was 
also found that m the case of a multiple-alphabet cipher involving standard alphabets, the plain- 
text equivalents of each alphabet reappeared on the same generatrix, and it was necessary only 
to combine the proper generatrices in order to produce the plain text of the message. In the 
case at hand both processes are combined: the normal alphabet sequence is continued beneath 
the letters of each column and then the generatrices are combined to produce the plain text. 
The completely developed generatrix diagrams for the first two columns are as follows (Fig. 16): 
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1 3 

C 0 
S Q 
N E 
R 0 
M 0 

0 N 

1 V 
T H 
S T 
D I 
S H 
E X 
F R 
N F 
W 0 
E D 
S 0 
A T 
I C 
C A 

fnourn 



Count* 1 

FVQUPRLWVGVHIQZHVDLF 

1 GWRVQSMXWHWIJRAIWEMG 

2 HXSWRTNYXIXJKSBJXFNH 

3 IYTXSUOZYJYKLTCKYGOI 

4 JZUYTVPAZKZLMUDLZHPJ 

5 KAVZUWQBALAMNVEMAIQK 

6 LBWAVXRCBMBNOWFNBJRL 

7 MCXBWYSDCNCOPXGOCKSM 

8 NDY CXZTEDODPQYHPDLTN 

9 OEZDYAUFEPEQRZI QEMUO 

10 PFAEZBVGFQFRSAJRFNVP 

11 QGBFACWHGRGSTBKSGOWQ 

12 RHCGBDXIHSHTU CLTHPXR 

13 SIDHCEYJITIUVDMUIQYS 

14 T JEIDFZKJU JVWENV JRZT 

15 UKFJEGALKVKWXFOWKSAU 
18 VLGKFHBMLWLXYGPXLTBV 

17 WMHLGI CNMXMYZHQYMU CW 

18 XNIMHJDONYNZAIRZNVDX 

19 YOJNIKEPOZOABJSAOWEY 

20 ZPKOJLFQPAPBCKTBPXFZ 

21 AQLPKMGRQBQCDLUCQYGA 

22 BRMQLNHSRCRDEMVDRZHB 

23 CSNRMOITSDSEFNWESAI C 

24 DTOSNPJUTETFGOXFTBJD 

25 EUPTOQKVUFUGHPYGUCKE 

Iknail 



Coiuxn 3 

NPDNNMUGSHGWQENCNSBZ 

1 OQEOONVHTIHXRFODOTCA 

2 PRFPPOWIUJIYSGPEPUDB 

3 QSGQQPXJ VKJ ZTHQFQVEC 

4 RTHRRQYKWLKAUIRGRWFD 

5 SUISSRZLXMLBVJ SHSXGE 

6 TVJTTSAMYNMCWKTITYHF 

7 UWKUUTBNZONDXLUJUZIG 

8 VXLWUCOAPOEYMVKVAJH 

9 WYMWWVDPBQPFZNWLWBKI 

10 XZNXXWEQCRQGAOXMXCLJ 

11 YAOYYXFRDSRHBPYNYDMK 

12 ZBPZZYGSETSICQZOZENL 

13 ACQAAZHTFUTJDRAPAFOM 

14 BDRBBAIUGVUKESBQBGPN 

15 CESCCBJVHWVLFTCRCHQO 

16 DFTDDCKWIXWMGUDSDIRP 

17 EGUEEDLXJYXNHVETEJSQ 

18 FHVFFEMYKZYOIWFUFKTR 

19 GIWGGFNZLAZPJXGVGLUS 

20 HJXHHGOAMBAQKYHWHMVT 

21 IKYI IHPBNCBRLZIXINWU 

22 JLZJJIQCODCSMAJYJOXV 

23 KMAKKJRDPEDTNBKZKPYW 

24 LNBLLKSEQFEUOCLALQZX 

25 MOCHMLTFRGFVPDMBMRAY 



j. Combining the selected generatrices . — After some experi- 
menting with these generatrices the 23d generatrix of Column 1 and 
the 1st of Column 2, which yield the digraphs shown in Fig. 17a, 
are combined. The generatrices of the subsequent columns are 
examined to select those which may be added to these already 
selected in order to build up the plain text The results are shown 
in Fig. 176. This process is a very valuable aid m the solution of 
messages after the primary component has been recovered as a 
result of the longer and more detailed analysis of the frequency 
distributions of the first message intercepted. Very often a short 
message can be solved in no other way than the one shown, 
if the primary component is completely known. 

g. Recovery oj the key . — It may be of interest to find the key 
word for the message. Assuming that enciphering method num- 
ber 1 (see Par. 7/, page 6) were known to be employed, all that 
is necessary is to set the mixed component of the cipher alphabet 
underneath the plain component so as to produce the cipher letter 
indicated as the equivalent of any given plain-text letter in each 
of the alphabets. For example, in the first alphabet it is noted that 
Cp=S 0 . Adjust the two components under each other so as to 
bring S of the cipher component beneath C of the plain component, 
.thus: 



13 3 

C 0 F 
S Q U 
N E N 
R 0 0 
M 0 U 

0 N H 

1 V E 
T H R 
S T 0 
DIN 
S H X 
EXT 
FRO 
N F I 
W 0 H 
E D Y 
SOU 
ATT 
I C H 
CAP 



4 18 7 

I R S T 
A D R 0 
E M Y T 
P D I S 
N T E D 
I L L F 
NINE 
E E W E 
F G 0 0 
TENT 
LINE 
ENDS 
M C 0 R 
E L D T 
U N D R 
ARDS 
T H X I 
A C K R 
ARDS 
T 



novas 178. 
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Plain. ABCDEFOTIJKU^OPQRSTUVWXYZABCDEFXMIJKLMNOPQRSTUVWXYZ 

Cipher EXHAUSTINGBCDFJKLMOPQRVWYZ 

It is noted that Ap=A s . Hence, the first letter of the key word to the message is A. The 2d, 
3d, 4th, . . . 7th key letters are found in exactly the same manner, and the following is obtained: 

When C 0 F I R S T equals 

SFDZRYR then A, successively equals 
AZIMUTH 

24. Summation of relative frequencies as an aid to the selection of the oorreot generatrices. — 
a. In the foregoing example, under subparagraph /, there occurs this phrase: “After some 
experimenting with these generatrices . . .” By this was meant, of course, that the selection of 
the correct initial pair of generatrices of plain-text equivalents is in this process a matter of trial 
and error. The test of “correctness” is whether, when juxtaposed, the two generatrices so 
selected yield “good” digraphs, that is, high-frequency digraphs such as occur in normal plain 
text. In his early efforts the student may have some difficulty in selecting, merely by ocular 
examination, the most likely generatrices to try. There may be in each diagram several gen- 
eratrices which contain good assortments of high-frequency lettera, and the number of trials of 
combinations of generatrices may be quite large. Perhaps a simple mathematical method may 
be of assistance in the process. 

b. Suppose, in Fig. 16, that each letter were accompanied by a number which corresponds 
to its relative frequency in normal English telegraphic text. Then, by adding the numbere along 
each horizontal line, the totals thus obtained will serve as relative numerical measures of the 
frequency values of the respective generatrices. Theoretically, the generatrix with the greatest 
value will be the correct generatrix because its total will represent the sum of the individual 
values of the actual plaintext letters. In actual practice, of course, the generatrix with the 
greatest value may not be the correct one, but the correct one will certainly be among the three 
or four generatrices with the largest values. Thus, the number of trials may be greatly reduced, 
in the attempt to put together the correct generatrices. 

e. Using the preceding message as an example, note the respective generatrix values in Fig. 
18. The frequency values of the respective letters shown in the figure are based upon the normal 
distribution for War Department telegraphic text (see Table 3, Appendix 1, Military Crypt- 
analysis, Part I). 
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Column 1 

Generatrix nta 

0 F V Q U P R L W V G V H I Q Z H V D L P 

* s 0 i s • 4 s a a 1 s 7 o o > i 4 4 * 57 

1 G W R V Q S M X W H W I J R A I W E II 6 

33>aoaaeasa70877auaa 77 

2 H X S W R T N Y X I X J K S B J X F N H 

a o s a a a a a o 7 o o o s i o o a a a 66 

3 IYTXSUOZYJYKLTCKYGOI 

73»oesaoao304«ao3aa7 74 

4 JZUYTVPAZKZLMUDLZHP J 

ooaaaaa7aoD4aa44oaao 49 

5 K A V Z U W Q B A L A M N V E M A I Q K 

073082017472811127700 74 

6 L B W A V X R C B U B N 0 W F N B J R L 

41273088131803281084 73 

7 M C X B W Y S D C N C 0 P X G 0 C K S U 

32013884888880388083 66 

8 NDYCXZTEDODPQYHPDLTN 

843800018484803884408 91 

9 OEZDYAUFEPEQRZIQEMUO 

818043788123130807018288 HO 

10 PFAEZBVGFQFRSA JRFNVP 

387180133803887083820 82 

11 QGBFACWHGRGSTBKSGOWQ 

03187331382801003830 67 

12 RHCGBDXIHSHTUCLTHPXR 

88831407883088403808 82 

13 SIDHCEYJITIUVDHUIQYS 

874881330707334287020 90 

14 TJEIDFZKJUJVWENVJRZT 

0018748000803318830800 83 

15 UKFJEGALKVKWXFOWKSAU 

308018374030308830071 65 

16 VLGKFHBULWLXYGPXLTBV 

24308312434022804013 50 

17 IMIHLGICNHXUYZHQYHUCV 

23343788303303032882 52 

18 XNIMHJDONYNZAIRZNVDX 

08738048818077808340 86 

19 YOJNIKEPOZOABJSAOVEY 

3808701888087108783183 103 

20 ZPKOJLFQPAPBCKTBPXFZ 

08080430878180018080 51 

21 AQLPKMGRQBQCDLUCQYGA 

70480338010844880337 55 

22 BRMQLNHSRCRDEHVDRZHB 

183048888884183248081 88 

23 CSNRMOITSDSEFNWESAIC 

3888387064818803180773 129 

24 DTOSNP JUTETFGOXFTB JD 

408681010HOS3B010104 102 

25 EUPTOQKVUFUGHPYGUCKE 

1881080038181183118413 78 
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Column 2 

Generatrix Frequency w 

0 NPDNNMUGSHGWQENCNSBZ 

8848833268220 13 838810 90 

1 0QE00NVHTIHXRF0D0TCA 

801888838978088848887 119 

2 PRFPPOWIUJIYSGPEPUDB 

883888273073038 13 8841 84 « 

3 QSGQQPXJVKJZTHQFQVEC 

082003002000030302133 46 

4 RTHRRQYKWLKAUIRGRWFD 

80888020340737828224 88 

5 SUISSRZLXHLBV JSHSXGE 

037808040241208380213 79 

6 TVJTTSAMYNMCWKTITYHF 

02090873282820079283 94 

7 UWKUUTBNZONDXLUJUZIG 

83038018088404808072 68 

8 VXLVVUCOAPOEYMVKVAJH 

204223387381832302708 73 

9 WYMWWVDPBQPFZNWLWBKI 

22222248102808242107 50 

10 XZNXXWEQCRQGAOXMXCLJ 

008002130380278020840 60 

11 YAOYYXFRDSRHBPYNYDMK 

27822038488313282420 75 

12 ZBPZZYGSETSICQZOZENL 

013003281308780080 IS 84 85 

13 ACQAAZHTFUTJDRAPAFOM 

73077080330048787882 93 

14 BDRBBAIUGVUKESBQBGPN 

148117732280130101228 73 . 

15 CESCCBJVHWVLFTCRCHQO 

3 13 633102822430383308 79 

16 DFTDDCKWIXWMGUDSDIRP 

48044302703223484788 77 

17 EGUEEDLXJYXNHVETEJSQ 

132318 13 440020832130 13 080 108 

18 FHVFFEMYKZYOIWFUFKTR 

33238 13 22002872333008 76 

19 GIWGGFNZLAZPJXGVGLUS 

27222380470800222486 59 

20 HJXHHGOAHBAQKYHVHMVT 

80083287217002323229 59 .. 

21 IKYIIHPBNCBRLZIXINWU 

70277331821840707823 81 

22 JLZJJIQCODCSMAJYJOXV 

04000708843027020802 56 

23 KMAKKJRDPEDTNBKZKPYW 

027000848184081000332 66 

24 LNBLLKSEQFEUOCLALQZX 

4814408130318388474000 85 

25 MOCMMLTFRGFVPDMBMRAY 

28881401838284313873 77 

FlOUU 18. 
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d. It will be noted that the frequency value of Hie 23d generatrix for the first column of 
cipher letters is the greatest; that of the first generatrix for the second column is the greatest. 
In both cases these are the correct generatrices. Thus the selection of the correct generatrices 
in such cases has been reduced to a purely mathematical basis which is at times of much assistance 
in effecting a quick solution. Moreover, an understanding of the principles involved will be of 
considerable value in subsequent work. 

2&. Solution by the probable-word method. — a. Occasionally one may encounter a crypto- 
gram which is so short that it contains no recurrences even of digraphs, and thuB gives no indi- 
cations of the number of alphabets involved. If the sliding mixed component is known, one may 
apply the method illustrated in Par. 15, assuming the presence of a probable word, checking it 
against the text and the sliding components to establish a key, if the correspondents are using 
key words. 

5. For example, suppose that the presence of the word ENEMY is assumed in the message 
in Par. 235 above. One proceeds to check it against an unknown key word, sliding the already 
reconstructed mixed component against the normal and starting with the first letter of the 
cryptogram, in this manner: 

When ENEMY equals 

SFDZR then A p successively equals 
XENFW 

The sequence XENFW spells no intelligible word. Therefore, the location of the assumed word 
ENEMY is shifted one letter forward in the cipher text, and the test is made again, just as was 
explained in Par. 15. When the group AQRLU is tried, the key letters ZIMUT are obtained, 
which, taken as a part of a word, suggests the word AZIMUTH. The method must yield solution 
when the correct assumptions are made. 

c. The danger to cryptographic security resulting from the inclusion of cryptographed 
addresses and signatures in cryptographic messages becomes quite obvious in the light of 
solution by the probable-word method. To illustrate, reference iB made to the message employed 
in Pais. 19-22. It will be noted in Par. 225 that the message carried a signature (Treer, Col ) 
and that the latter was enciphered. Suppose that this were an authorized practice, and that 
every message could be assumed to conclude with a cryptographed signature. The signature 
“TREER COL” would at once afford a very good basis for the quick solution of subsequent mes- 
sages emanating from the same headquarters as did the first message, because presumably this 
same signature would appear in other messages. It is for this reason that addresses and signa- 
tures must not be cryptographed; if they must be included they Bhould be cryptographed in a 
totally different system or by a wholly different method, perhaps by means of a special address 
and signature code. It would be best, however, to omit all addresses and signatures, and to 
let the call signs of the headquarters concerned also convey these parts of the message, leaving 
the delivery to the addressee a matter for local action. 

26. Solution when the plain component is a mixed sequence, the cipher component, the 
normal. — a. This falls under Case B (2) outlined in Par. 6. It is not the usual method of 
employing a single mixed component, but may be encountered occasionally in cipher devices. 

5. The preliminary steps, as regards factoring to determine the length of the period, are 
the same as usual. The message is then transcribed into its penods. Frequency distributions 
are then made, as usual, and these are attacked by the principles of frequency and recurrence. 
An attempt is made to apply the principles of direct symmetry of position, but thiB attempt 
will be futile, for the reason that the plain component is in this case an unknown mixed sequence. 
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(See Par. 18(2.) Any attempt to find symmetry in the secondary alphabets based upon the normal 
sequence can therefore disclose no symmetry because the symmetry which exists is based upon a 
wholly different sequence. 

e. However, if the principles of direct symmetry of position are of no avail in this case, 
there are certain other principles of symmetry which may be employed to great advantage. 
To explain them an actual example will be used. Let it be assumed that it is known to the 
cryptanalyst that the enemy is using the general system under discussion, vie, a mixed sequence, 
variable from day to day, is used as plain component; the normal sequence is used as cipher 
component; and a repeating key, variable from message to message, is used in the ordinary 
manner. 

The following message has been intercepted: 
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d A study of the recurrences and factoring their intervals discloses that five alphabets are 
involved. Uniliteral frequency distributions are made and are shown in Fig. Ida: 



Alphabet 1 

3 =4 3 C- 3 

ABCDEFGHIJKLMNOPQRSTUVWZYZ 

Alphabet 2 

=4 % as It as! 

| N 5 | g | ^ 

ABCDEFGHIJKLMNOPQRSTUVWZYZ 
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Alphabets 

S ! 8 ' 88 g 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Alphabet 4 

5 „ 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Alphabet 5 



g g 5? Sl g - 

g g 5* g - 3 - ggg* gg 3 .IvSggg 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Tiaou 19a. 

e. Since the cipher component in this case is the norms! alphabet, if follows that the Jive 
frequency distributions are based upon a sequence which is known, and therefore, the five frequency 
distributions should manifest a direct symmetry of distribution of crests and troughs. By virtue of 
this symmetry and by shifting the five distributions relative to one another to proper superim- 
positions, the several distributions may be combined into a single uniliteral distribution. Note 
how this shifting has been done in the case of the five illustrative distributions: 

Alphabet 1 

^-.gsssass^g § 3 ^ 

- - g g g g g 3 g g g ^ g 3 gggg gg 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Alphabet 2 

§ == == 

« ^ % g g g g 

^ -«g ggg33g3-«.g3g 3 g g g g g ^ 

XYZABCDEFGHIJKLMNOPQRSTUVW 

Alphabet 3 
g % % 

g g g g g g 

^ ^ jgj ^ ^ ^ ^ S; ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ 

TUVWXYZABC DEFGHIJKLMNOPQRS 

Alphabet 4 

ggg g ig 

OPQRSTUVWXYZABCDEFGHIJKLMN 

Alphabet 5 

% i 

g^g g 3 g 3 g 

3 ~.g~.3ggggg=s g 3 ^ g g g s: gg 

RSTUVWXYZABCDEFGKIJKLMNOPQ 

Phiomim. 



917974 0 - 43 -4 
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f. The superimposition of the respective distributions enables one to convert the cipher 
letters of the five alphabets into one alphabet. Suppose it is decided to convert Alphabets 
2, 3, 4, and 5 into Alphabet 1. It is merely necessary to substitute for the respective letters in 
the four alphabets those which stand above them in Alphabet 1. For example, in Fig. 19ft, X, 3 

in Alphabet 2 is directly under A, in Alphabet 1 ; hence, if the superimposition is correct then 
X 0 =X„- Therefore, in the cryptogram it is merely necessary to replace every X, in the second 

position by A e . Again T, in Alphabet 3— A s in Alphabet 1; therefore, in the cryptogram one 1 

replaces every T, in the third position by A„. The entire process, hereinafter designated as 
conversion into monoalphabetic terms, gives the following converted message: 
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The uniliteral frequency distribution for this converted text follows. Note that the frequency 
of each letter is the sum of the five frequencies in the corresponding columns of Fig. 19ft. 
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g. The problem having been reduced to monoalph&betic terms, a triliteral frequency distri- 
bution can now be made and solution readily attained by simple principles. It yields the 
following: 

JAPAN CONSULTED GERMANY TODAY ON REPORTS THAT THE COMMUNIST INTERNATIONAL 
WAS BEHIND THE AMAZING SEIZURE OF GENERALISSIMO CHIANG KAI SHEK IN CHINA. 
TOKYO ACTED UNDER THE ANTICOMMUNIST ACCORD RECENTLY SIGNED BY JAPAN AND GER- 
MANY. THE PRESS SAID THERE WAS INDISPUTABLE PROOF THAT THE COMINTERN INSTI- 
GATED THE SEIZURE OF GENERAL CHIANG AND SOME OF HIS GENERALS. MILITARY OB- 
SERVERS SAID THE COUP WOULD HAVE BEEN IMPOSSIBLE UNLESS GENERAL CHANG HSUEN 
LIANG HOTHEADED FORMER WAR LORD OF MANCHURIA HAD FORMED AN ALLIANCE WITH THE 
COMMUNIST LEADERS HE WAS SUPPOSED TO BE FIGHTING. SUCH AN ALLIANCE THESE 
OBSERVERS DECLARED OPENED UP A RED ROUTE FROM MOSCOW TO NORTH AND CENTRAL 
CHINA. 

h. The reconstruction of the plain component is now a very simple matter. It is found to 
be as follows: 

HYDRAULICBEFGJKMNOPQSTVWXZ 

Note also, in Fig. 196, the keyword for the message, (HEAVY), the letters being in the col umns 
headed by the letter H. 

i. The solution of subsequent messages with different keys can now be reached directly, by 
a simple modification of the principles explained in Par 18. This modification consists in using 
for the completion sequence the mixed plain component (now known) instead of the normal alpha- 
bet, after the cipher letters have been converted into their plain-component equivalents. Let 
the student confirm this by experiment. 

j. The probable-word method of solution discussed under Paragraph 20 is also applicable 
here, in case of very short cryptograms. This method presupposes of course, possession of the 
mixed component and the procedure is essentially the same as that in Par 20. In the example 
discussed in the present paragraph, the letter A on the plain component was successively set 
against the key letters HEAVY; but this is not the only possible procedure. 

k. The student should go over carefully the principle of “conversion into monoalphabetic 
terms” explained in subparagraph / above until he thoroughly understands it. Later on he will 
encounter cases in which this principle is of very great assistance in the cryptanalysis of more 
complex problems. (Another example will be found under Par. 45 ) 

l. The principle illustrated in subparagraph e, that is, shifting two or more monoalphabetic 
frequency distributions relatively so as to bring them into proper alignment for amalgamation 
into a single monoalphabetic distribution, is called matching. It is a very important crypt- 
analytic principle. Note that its practical application consists m sliding one monoalphabetic 
distribution against the other so as to obtain the best comcidence between the entire sequence 
of crests and troughs of one distribution and the entire sequence of crests and troughs of the other 
distribution. When the best point of coincidence has been found, the two sequences may be 
amalgamated and theoretically the single resultant distribution will also be monoalphabetic in 
character. The successful application of the principle of matching depends upon several factors. 
First, the cryptographic situation must be such that matching is a correct cryptographic step. 
For example, the distributions in figure 196 are properly subject to matching because the cipher 
component in the basic sequences concerned m this problem is the normal sequence, while the 
plain component is a mixed sequence. But it would be futile to try to match the distributions 
in figure 9, for in that case the cipher component is a mixed sequence, the plain component is 
the normal sequence. Hence, no amount of shifting or matching can bring the distributions of 
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figure 9 into proper superimpoaition for correct amalgamation. (If the occurrences in the various 
distributions in figure 9 had been distributed according to the sequence of letters in the mixed 
component, then matching would be possible; but in order to be able to distribute these occur- 
rences according to the mixed component, the latter has to be known — and that is just what is 
unknown until the problem has been solved.) A second factor involved in successful matching 
is the number of elements in the two distributions forming the subject of the test. If both 
of them have very few tallies, there is hardly sufficient information to permit of matching with 
any degree of assurance that the work is not in vain. If one of them has many tallies, the other 
only a few, the chances for success are better than before, because the positions of the blanks in 
the two distributions can be used as a guide for their proper superimpoaition. 

m. There are certain mathematical and statistical procedures which can be brought to bear 
upon the matter of cryptanalytic matching. These will be presented in a later text. However, 
until the student has studied these mathematical and statistical methods of matching distri- 
butions, he will have to rely upon mere ocular examination as a guide to proper superimposition. 
Obviously, the more data he has in each distribution, the easier is the correct superimpoaition 
ascertained by any method. 
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BEPEATING-KEY SYSTEMS WITH MIXED CIPHEB ALPHABETS, H 

Tancrspb 

Further ooaea to be oonaldered 27 

Identical primary mixed component* proceeding In the same direction 28 

Cryptographing and decryptographlng by means of identical primary mixed components 29 

Principles of solution 80 

27. Farther cases to be considered. — a. Thus far Cases B (1) and (2), mentioned in Para- 
graph 0 have been treated. There remains Case B (3), and this case has been further subdivided 
as follows: 

Cash B (3). Both components are mixed sequences. 

(a) Components are identical mixed sequences. 

(1) Sequences proceed in the same direction (The secondary alphabets are mixed 

alphabets.) 

(2) Sequences proceed in opposite directions. (The secondary alphabets are 

reciprocal mixed alphabets.) 

(b) Components are different mixed sequences. (The secondary alphabets are mixed 

alphabets.) 

6. The first of the foregoing subcases will now be examined. 

28. Identical primary mixed components proceeding in the same direction. — a. It is often 
the case that the mixed components are derived from on easily remembered word or phrase, 
so that they can be reproduced at any time from memory. Thus, for example, given the key 
word QUESTIONABLY, the following mixed sequence is derived: 

QUESTI0NABLYCDF6H JKHPRVRXZ 

b. By using this sequence as both plain and cipher component, that is, by sliding this 
sequence against itself, a series of 20 secondary mixed alphabets may be produced. In encipher- 
ing a message, sliding strips may be employed with a key word to designate the particular and 
successive positions in which the strips are to be set, the same as was the case in previous examples 
of the use of sliding components. The method of designating the positions, however, requires 
a word or two of comment at this point. In the examples thus far shown, the key letter, as 
located on the cipher component, was always set opposite A, as located on the plain component; 
possibly an erroneous impression has been created, viz, that this is invariably the rule. This 
is decidedly not true, as has already been explained in paragraph 7c. If it has seemed to be the 
case that 6 k always equals A,, it is only because the text has dealt thus far principally with cases in 
which the plain component is the normal sequence and its initial letter, which usually consti- 
tutes the index for juxtaposing cipher components, ib A. It must be emphasized, however, 
that various conventions may be adopted in this respect; but the most common of them is to 
employ the initial letter of the plain component os the index letter. That is, the index letter, 
8|, will be the initial letter of the mixed sequence, in this case, Q. Furthermore, to prevent the 
possibility of ambiguity it will be stated again that the pair of enciphering equations employed 
in the ensuing discussion will be the first of the 12 set forth under Far. 7/, viz, 0*/»=0i/i ; 0p/i=0«/i. 
In this case the subscript “1” means the plain component, the subscript *'2”, the cipher 
component, so that the enciphering equation is the following: 0*/«=0i/p; 0,/p =0«/«. 

(49) 
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c. By setting the two sliding components against each other in the two positions Bhown 
below, the cipher alphabets labeled (1) and (2) given by two key letters, A and B, are seen to be 
different 

Key Letter = A 0, 

4 

Plain component. QUESTIONABLYCDFGHJKMPRVWXZQUESTIONABLYCDFGHJKMPRVWXZ 

Cipher component QUESTIONABLYCDFGHJKMPRVWXZ 

r 

e* 

Secondary alphabet (1): 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher HJPRLVWXDZQKUGFEASYCBTIOMN 

Key Letter =B 0, 

4 

Plain component. QUESTIONABLYCDFGHJKMPRVWXZQUESTIONABLYCDFGHJKMPRVWXZ 

Cipher component QUESTIONABLYCDFGHJKMPRVWXZ 

t 

0a 

Secondary alphabet (2): 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher. JKRVYWXZFQUMEHGSBTCDLIONPA 

d. Very frequently a quadricular or square table is employed by the correspondents, instead 
of sliding strips, but the results are the same The cipher square based upon the word QUESTION- 
ABLY is shown in Fig. 21. It will be noted that it does nothing more than set forth the successive 
positions of the two primary sliding components; the top line of the square is the plain component, 
the successive horizontal lines below it, the cipher component in its various juxtapositions. The 
usual method of employing such a square (i. e , corresponding to the enciphering equations 
0k/o=6iA>; 0p/p=6«/«) is to take as the cipher equivalent of a plain-text letter that letter which 
hes at the intersection of the vertical column headed by the plain-text letter and the horizontal 
row begun by the key letter. For example, the cipher equivalent of Ep with keyletter T is the 
letter 0 e ; or Ep (T k )=0 s . The method given in paragraph b, for determining the cipher equiva- 
lents by means of the two sliding strips yields the same results as does the cipher square. 
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QUESTIONABLYCDFGHJKUPRVWXZ 
UESTIONABLYCDFGHJKMPRVWXZQ 
ESTIONABLYCDFGHJKUPRVWXZQU 
STlONABLYCDFGHJKIiPRVUZQUE 
TIONABLYCDFGHJKMPRVffXZQUES 
IONABLYCDFGH JKUPRVHZQUEST 
ONABLYCDFGHJKMPRVWXZQUESTI 
NABLYCDFGHJKliPRVWXZQUESTIO 
ABLYCDFGHJKHPRVVXZQUESTION 
BLYCDFGHJKMPRVVXZQUESTIONA 
LYCDFGHJKMPRVVXZQUESTIONAB 
YCDFGHJKMPRVWXZQUESTIONABL 
CDFGHJKMPRVffXZQUESTIONABLY 
DFGHJKMPRVWXZQUESTIONABLYC 
FGHJKMPRVWXZQUESTIONABLYCD 
GHJKUPRVWXZQUESTIONABLYCDF 
HJKHPRVVXZQUESTIONABLYCDFG 
JKMPRVWXZQUESTIONABLYCDFGH 
KHPRVWXZQUESTIONABLYCDFGHJ 
MPRVWXZQUESTIONABLYCDFGHJK 
PRVWXZQUESTIONABLYCDFGHJKM 
RVWXZQUESTIONABLYCDFGHJKMP 
VffXZQUESTIONABLYCDFGHJKMPR 
VXZQUESTIONABLYCDFGH JKHPRY 
X Z Q U E S T I 0 N A B L Y C D F G H J K M P R V W 
ZQUESTXONABLYCDFGHJKMPRVVX 

Viauu a. 

29. Cryptographing and deoryptographing by identical primary mixed components. — There 
is nothing of apodal interest to be noted in connection with the use either of identical mixed 
components or of an equivalent quadricular table such as that shown in Fig. 21, in endphenng or 
deciphering a message. The bade principles are the same as in the case of the sliding of one 
mixed component against the normal, the displacements of the two components being controlled 
by changeable key words of varying lengths. The components may be changed at will and so on. 
All this has been demonstrated adequately enough in Elementary Military Cryptography, and 
Advanced Military Cryptography. 

30. Prindples of solution. — a. Basically the principles of solution in the case of a crypto- 
gram enciphered by two identical mixed sliding components are the same as in the preceding 
case. Primary recourse is had to the principles of frequency and repetition of single letters, 
digraphs, trigraphs, and polygraphs Once an entering wedge has been forced into the problem, 
the subsequent steps may consist merely in continuing along the same lines as before, building 
up the solution bit by bit. 

b. Doubtless the question has already arisen in the student's mind as to whether any 
principles of symmetery of position can be used to assist in the solution and in the reconstruction 
of the cipher alphabets in cases of the kind under consideration. This phase of the subject will 
be taken up in the next section and will be treated in a somewhat detailed manner, because the 
theory and principles involved are of very wide application in cryptanalytics. 
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Section VII 

THEORY OF INDIRECT SYMMETRY OF POSITION IN SECONDARY ALPHABETS 1 

Paragraph 

Reconstruction of primary components from secondary alphabets 31 

31. Reconstruction of primary components from secondary alphabets. — a. Note the two 
secondary alphabets (1) and (2) given in paragraph 28e. Externally they show no resemblance 
or symmetry despite the fact that they were produced from the same primary components. 
Nevertheless, when the matter is studied with care, a symmetry of position is discoverable. 
Because it is a hidden or latent phenomenon, it may be termed latent symmetry of position. 
However, in previous texts the phenomenon has been designated as an indirect symmetry of position 
and this terminology has grown into usage, so that a change is perhaps now inadvisable. 
Indirect symmetry of position is a very interesting and exceedingly useful phenomenon in 
cryptanalytics. 

b. Consider the following secondary alphabet (the one labeled (2) in paragraph 28c): 

, . /Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

W (Cipher JKRVYWXZFQUMEHGSBTCDLIONPA 

c. Assuming it to be known that this is a secondary alphabet produced by two primary 
identical mixed components, it is desired to reconstruct the latter. Construct a chain of alter- 
nating plain-text and cipher-text equivalents, beginning at any point and continuing until the 
chain has been completed. Thus, for example, beginning with A,— J e , J P =Q 0 , Q P =B 0 , . . ., and 
dropping out the letters common to successive pairs, there results the sequence A J Q B . . .. By 
completing the chain the following sequence of letters is established: 

AJQBKULMEYPSCRTDVIFWOGXNHZ 

d. This sequence consists of 26 letters. When slid against itself it wUl produce exactly the 
same secondary alphabets as do the primary components based upon the word QUESTIONABLY. 
To demonstrate that this is the case, compare the secondary alphabets given by the two settings 
of the externally different components shown below: 

Plain component QUESTIONABLYCDFGHJKMPRVWXZQUESTIONABLYCDFGHJKMPRVWXZ 

Cipher component...- QUESTIONABLYCDFGHJKMPRVWXZ 

Secondary alphabet (1): 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher JKRVYWXZFQUMEHGSBTCDLIONPA 

Plain component AJQBKULMEYPSCRTDVIFWOGXNHZAJQBKULMEYPSCRTDVIFWOGXNHZ 

Cipher component AJQBKULMEYPSCRTDVIFWOGXNHZ 

Secondary alphabet (2): 

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher JKRVYWXZFQUMEHGSBTCDLIONPA 

1 After the student has read this and the next section it would be well for him to study Appendix 3, where 
another and perhaps simpler method is explained 
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e. Since the sequence A J Q B K . . . gives exactly the same equivalents in the secondary 
alphabets as the sequence QUEST. . . gives, the former sequence is cryptographically 
equivalent to the latter sequence. For this reason the A J Q B K . . . sequence is termed 
an equivalent primary component 1 If the real or original primary component is a key-word mixed 
sequence, it is hidden or latent within the equivalent primary sequence; but it can be made patent 
by decimation of the equivalent primary component The procedure is as follows: Find three 
letters in the equivalent primary component such as are likely to have formed an unbroken 
sequence in the original primary component, and see if the interval between the first and second 
is the same as that between the second and third. Such a cose is presented by the letters W, X, 
and Z in the equivalent primary component above. Note the sequence. . . WOGXNHZ. . . ; 
the distance or interval between the letters W, X, and Z is two letters Continuing the chain by 
adding letters two intervals removed, the latent original primary component is made patent. 
Thus: 



1 3 1 i t 9 7 8 9 10 U 13 U 14 U 19 17 18 U 20 21 22 23 2t 24 28 

WXZQUESTIONABLYCDFGHJKMPRV 

j. It is possible to perform the steps given in c and e in a combined single operation when the 
original primary component is a key-word mixed sequence. Starting with any pair of letters (in 
the cipher component of the secondary alphabet) likely to be sequent in the key-word mixed 
sequence, such as JK„ in the secondary alphabet labeled (2), the following chain of digraphs may 
be set up. Thus, J ( K,in the plain component stand over Q,U, respectively, m the cipher com- 
ponent ; Q , U , in the plain component stand over B , L , respectively, in the cipher component, and 
so on. Connecting the pairs in a series, the following results are obtained: 

JK -> QU -> BL -+ KM -» UE -» LY -» MP -» ES -» YC -> PR -> ST -» CD -» RV -> 
TI->DF-»VW->IO->FG->WX->ON'->GH-»XZ->NA->HJ-+ZQ->AB->JK. . . 

These may now be united by means of their common letters: 

JK-»KM->MP-»PR-»RV-»etc=JKMPRVVXZQUESTIONABLYCDFGH 

The original primary component is thus completely reconstructed. 

g. Not all of the 26 secondary alphabets of the series yielded by two sliding primary compo- 
nents may be used to develop a complete equivalent primary component. If examination be made, 
it will be found that only 13 of these secondary alphabets will yield complete equivalent primary 
components when the method of reconstruction shown in subparagraph c above is followed. For 
example the following secondary alphabet, which is also derived, from the primary components 
based upon the word QUESTIONABLY will not yield a complete chain of 26 plain text-cipher- 
plain text equivalents: 

Plain ABCDEFGHIJKLMNOPQRSTUVffXYZ 

Cipher. CDHJ OKMPBRVFWYLXTZNAIQUEGS 



* Such an equivalent component la merely a sequence which has been or can be developed or derived from 
the original sequence or basic primary component by applying a decimation process to the latter; conversely, 
the original or basic component can be derived from an equivalent component by applying the same sort of 
process to the equivalent component. By decimation is meant the selection of elements from a sequence accord- 
ing to some fixed interval. For example, the sequence A E I K . . .is derived, by decimation, from the 
normal alphabet by selecting every fourth letter. 
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Equivalent primary component: 

ltt«f*TB«UU nulls* 

ACHPZEOLFK VQT| ACH . . . (The A C H sequence begins again.) 

h. It is seen that only 13 letters of the chain have been established before the sequence begins 
to repeat itself. It is evident that exactly one-half of the chain has been established. The other 
half may be established by beginning with a letter not in the first half. Thus: 

isi4i»7stionun|isi 

BDJRZSNY6URUI |BDJ . . . (The B D J sequence begins again.) 

i. It is now necessary to distribute the letters of each half-sequence within 26 spaces, to 
correspond with their placements in a complete alphabet. This can only be done by allowing a 
constant odd number of spaces between the letters of one of the half-sequences. Distributions 
are therefore made upon the basis of 3, 6 , 7, 9, . . . spaces. Select that distribution which 
most nearly coincides with the distribution to be expected in a key-word component. Thus, for 
example, with the first half-sequence the distribution selected is the one made by leaving three 
spaces between the letters. It is as follows: 

1 3 S 4 S « 7 8 I 10 11 U U li U 11 17 U >1 S 91 a a » » a 

A — L — C — F — H — K — P — V — X — Q — E — T — 0 — 

j. Now interpolate, by the same constant interval (three in this case), the letters of the other 
half-sequence. Noting that the group F - H appears in the foregoing distribution, it is apparent 
that G of the second half-sequence should be inserted between F and H. The letter which imme- 
diately follows G in the second half-sequence, viz, M, is next inserted in the position three spaces to 
the right of G, and so on, until the interpolation has been completed. This yields the original 
primary component, which is as follows: 

1 3 S 4 C 8 7 8 8 U 11 13 13 14 15 16 17 18 18 20 31 33 38 34 35 36 

ABLYCDFGHJKMPRVWXZQUESTION 

k. Another method of handling cases Buch as the foregoing is indicated in subparagraph/ 
By extending the principles set forth in that subparagraph, one may reconstruct the following 
chain of 13 pairs from the secondary alphabet given in subparagraph g: 

1 3 8 4 6 4 7 8 8 10 11 12 U I 1 

CD->HJ->PR-*XZ-»ES-*ON-*LY->FG->KM-*VW-»QU-*TI->AB}-» CD. . . 

Now find, in the foregoing chain, two pairs likely to be sequent, for example HJ and KH and count 
the interval between them in the chain. It is 7 (counting by pairs). If this decimation interval 
is now applied to the chain of pairs, the following is established: 

1 3 3 4 4 8 7 8 8 10 11 13 13 14 IS 14 17 18 18 30 31 S3 38 34 3E 38 

HJKMPRVWXZQUESTIONABLYCDFG 

l. The reason why a complete chain of 26 letters cannot be constructed from the secondary 

alphabet given under subparagraph g is that it represents a case in which two primary com- 
ponents of 26 letters were slid an even number of intervals apart. (This will be explained in 
further detail in subparagraph r below.) There are in all 12 such cases, none of which will 
admit of the construction of a complete chain of 26 letters. In addition, there is one case where- 
in, despite the fact that the primary components are an odd number of intervals apart, the 
secondary alphabet cannot be made to yield a complete chain of 26 letters for an equivalent 

primary component This is the case in which the displacement is 13 intervals. Note the 

secondary alphabet based upon the primary components below (which are the same as those 
shown in subparagraph d): 




REF ID:A64560 



55 



Pbimabt Components 

QUESTIONABLYCDFGHJKMPRVWXZ 

DFGHJKMPRVWXZQUESTIONABLYC 

Secondabt Alphabet 

Plain- ABCDEFGHI JXLHNOPQRSTUHIYZ 

Cipher RVZQGUESKTIROPMNDAHJFBLYXC 

m. If an attempt is made to construct a chain of letters from this secondary alphabet alone, 
no progress can be made because the alphabet is completely reciprocal. However, the crypt* 
analyst need not at all be baffled by this case. The attack will follow along the lines shown below 
in subparagraphs n and o. 

n. If the original primary component is a key-word mixed sequence, the cryptanalyst may 
reconstruct it by attempting to “dovetail” the 13 reciprocal pairs (AR,BV,CZ,DQ.EG,FU,HS, 
IK, JT,LW,M0, NP, and XY) into one sequence. The members of these pairs are all 13 intervals 
apart. Thus: 

01184897S910U1318 

A R 

B V 

C Z 

D Q 

E G 

F U 

H S 

I K 

J T 

L W 

H 0 

N P 

X Y 

Fraoss 23. 

Write out the series of numbers from 1 to 26 and insert as many pairs into position as possible, 
being guided by considerations of probable partial sequences in the key-word mixed sequence, 
Thus: 

01 13 48 97 S910UU18 14 1S18 

ABCD RVZQ 

It begins to look as though the key-word commences with the letter Q, in which case it should 
be followed by U. This means that the next pair to be inserted is FU. Thus: 

0 1 3 I 4 « 8 7 S 9 10 11 13 11 14 18 18 17 

ABCDF RVZQU 

The sequence ABCDF means that E is in the key. Perhaps the sequence isABCDFGH. 
Upon trial, using the pairs EG and HS, the following placements are obtained: 

0 1 3 8 4 8 6 7 8 9 10 II 12 18 14 IS 18 17 IS 19 

ABCDFGH RVZQUES 

This suggests the word QUEST or QUESTION. The pair JT is added: 

• 1 3 8 4 8 8 7 a 9 10 U 13 18 14 18 18 17 18 19 30 

ABCDFGHJ RVZQUEST 



o 
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The sequence G H J suggests GH J K, which places an I after T. Enough of the process has 
been shown to make the steps clear. 

o. Another method of circumventing the difficulties introduced by the 14th secondary 
alphabet (displacement interval, 13) is to use it in conjunction with another secondary alphabet 
which is produced by an even-interval displacement. For example, suppose the following two 
secondary alphabets are available. 1 

0. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

1 RVZQGUESKTIWOPMNDAHJFBLYXC 

2 XZESKTIORNAQBWVLHYMPJ CDFUG 

Fiau&x 38 

The first of these secondaries is the 13-interval secondary; the second is one of the even- 
interval secondaries, from which only half-chain sequences can be constructed. But if the con- 
struction be based upon the two sequences, 1 and 2 in the foregoing diagram, the following is 
obtained: 

RXUTNLDHMVZEIAYFJPWQSOBCGK 

This is a complete equivalent primary component. The original key-word mixed component 
can be recovered from it by decimation based upon the 9th interval: 

RVWXZQUESTIONABLYCDFGHJKHP 

p. (1) When the primary components are identical mixed sequences proceeding in opposite 
directions, all the secondary alphabets will be reciprocal alphabets. Reconstruction of the 
primary component can be accomplished by the procedure indicated under subparagraph o 
above. Note the following three reciprocal secondary alphabets: 

1 3 S 4 5 8 7 8 3 10 11 IS » 14 U IS 17 n W 30 31 33 38 34 SB SB 

fi-„. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

1.. .. PMHGQFDCWYLKBRVAENZXUOITJS 

2 WVMKSJHGQFDRCXZYILEUTBANPO 

3.. .. TSQZLXWVNRPEHIOKCJBAYHGFUD 

Piovmi 34. 

(2) Using lines 1 and 2, the following chain can be constructed (equivalent primary com- 
ponent): 

PRQSOBCGXRXUTNLDHIIVZEIAYFJ 

1 The method of writing down the secondaries shown in figure 23 will hereafter be followed in all cases when 
alphabet reconstruction skeletons are necessary. The top line will be understood to be the plain component; it 
is common to all the secondary alphabets, and is set off from the cipher components by the heavy black line. 
This top line of letters will be designated by the digit 0, and will be referred to as "the sero line” in the diagram. 
The successive lines of letters, which occupy the space below the sero line and which contain the various cipher 
components of the several secondary alphabets, will be numbered serially. These numbers may then be used as 
reference numbers for designating the horizontal lines in the diagram. The numbers standing above the letters 
may be used as reference numbers for the vertical columns In the diagram. Hence, any letter in the reconstruc- 
tion skeleton may be designated by coordinates, giving the horizontal or X coordinate first. Thus, D (2-11) 
means the letter D standing in line 2, Column 11. 
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Or, using lines 2 and 8: 

WTYKZODPUAGVSLJXICMQNFREBH 

The original key-word mixed primary component (based on the word QUESTIONABLY) can 
be recovered from either of the two foregoing equivalent primary components. But if lines 1 
and 3 are used, only half-chains can be constructed: 

PTFXAKECVOHQL and USDVNJUYRIGZB 

This is because 1 and 3 are both odd-interval secondary alphabets, whereas 2 is an even- 
interval secondary. It may be added that odd-interval secondaries are characterized by having 
two cases in which a plain-text letter is enciphered by itself; that iB, 6 P is identical with 0«. 
This phrase “identical with” will be represented by the symbol a ; the phrase “not identical 
with” will be represented by the symbol . (Note that in secondary alphabet number 1 above, 
F p aF ( and U p vU«; in secondary alphabet number 3 above, M P =M„ and 0 p e=0 8 ). This charac- 
teristic will enable the cryptanalyst to select at once the proper two secondaries to work with in 
case several are available; one should show two coses where 9 ,b 0,; the other should show 
none. 

q. (1) When the primary components are different mixed sequences, their reconstruction 
from secondary cipher alphabets follows along the same lines as set forth above, under b to j, 
inclusive, with the exception that the selection of letters for building up the chain of equivalents 
for the primary cipher component is restricted to those below the zero line in the reconstruction 
skeleton. Having reconstructed the primary cipher component, the plain component can be 
readily reconstructed. This will become clear if the student will study the following example. 

0 -... ABCDEFGHIJKLMNOPQRSTUVWXYZ 
l.„ TVABULIQXYCVSNDPFEZGRHJK1I0 
2 ZJSTVIQRMONKXEAGBWPLHYCDFU 

haul* SB. 

(2) Using only lines 1 and 2, the following chain is constructed: 

TZPGLIQRHYOUVJ CNEWKDASXMFB 

This is an equivalent primary cipher component. By finding the values of the successive 
letters of this chain in terms of the plain component of secondary alphabet number 1 (the zero 
line), the following is obtained: 

TZPGLIQRHYOUVJ CNEWKDASXMFB 
ASPTFGHUVJZEBWKNRLXOCMIYQD 

The sequence A S P T . . . is an equivalent primary plain component. The original key- 
word mixed components may be recovered from each of the equivalent primary components. 
That for the primary plain component is based upon the key PUBLISHERS MAGAZINE; that for 
the primary cipher component is based upon the key QUESTIONABLY. 
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(3) Another method of accomplishing the process indicated above can be Illustrated graphi- 
cally by the following two chains, based upon the two secondary alphabets set forth in sub- 
paragraph q (1): 

1 2 • 4 I < r S 9 10 U 12 18 14 15 18 17 18 19 10 81 23 » Si 18 SB 

0. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

1 TVABULIQXYCWSNDPFEZGRHJKMO 



Z J S T V 

Cd 1 


IQRMONKXEAGB 

Col 3. 


VPLHYC 


A (0-1) 


-* 


T (l-l); 


-> 


T (2-4) ~> 


D (0-4); — * 


D (0—4) 


— » 


B (1-4); 


— > 


B (2-17) -» 


Q (0-17); -* 


Q (0-17) 


— » 


F (1-17); 


— > 


F (2-25) -» 


Y (0-25); 


Y (0-25) 




M (1-25); 




M (2-9) -* 


i (0-9); - 


1(0-9) 




X (1-9); 


— > 


X (2-13) -» 


M (0-13); 


M (0-13) 
etc. 


— » 


S (1-13); 
etc. 




S (2-3) -> 


C (0-3); -» 



Fioubz 28. 



(4) By joining the letters in Column 1, the following chain is obtained: A D Q Y I H, etc. 
If thin be examined, it will be found to be on equivalent primary of the sequence based upon 
PUBLISHERS MAGAZINE. By joining the letters in Column 2, the following chain is obtained: 
T B F M X S. This is an equivalent primary of the sequence based upon QUESTIONABLY. 

r. A final word concerning the reconstruction of primary components in general may be 
added. It has been seen that in the case of a 26-element component sliding against itself (both 
components proceeding in the same direction), it is only the secondary alphabets resulting from 
odd-interval displacements of the primary components which permit of reconstructing a single 
26-letter chain of equivalents This is true except for the 13th interval displacement, which 
even though an odd number, still acts like an even number displacement in that no complete 
chain of equivalents can be established from the secondary alphabet. This exception gives the 
due to the basic reason for this phenomenon: it is that the number 26 has two factors, 2 and 13, 
which enter into the picture. With the exception of displacement-interval 1, any displacement 
interval which is a sub-multiple of, or has a factor in common with the number of letters in the primary 
sequence will yield a secondary alphabet from which no complete chain of 26 equivalents can be 
derived for the construction of a complete equivalent primary component. This general rule is 
applicable only to components which progress in the same direction; if they progress in opposite 
directions, all the secondary alphabets are reciprocal alphabets and they behave exactly like 
the reciprocal secondaries resulting from the 13-interval displacement of two 26-letter identical 
components progressing in the same direction. 

8. The foregoing remarks give rise to the following observations based upon the general 
rule pointed out above. Whether or not a complete equivalent primary component is derivable 
by decimation from an original primary component (and if not, the lengths and numbers of ohaina 
of letters, or incomplete components, that can be constructed in attempts to derive such equiv- 
alent components) will depend upon the number of letters in the original primary component 
and the specific decimation interval sdected. For example, in a 26-letter original primary com- 
ponent, decimation interval 5 will yield a complete equivalent primary component of 26 letters, 
whereas decimation intervals 4 or 8 will yield 2 chains of 13 letters each. In a 24-letter compo- 
nent, decimation interval 5 will also yield a complete equivalent primary component (of 24 letters), 
but decimation interval 4 will yield 6 chains of 4 letters each, and decimation interval 8 will 
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yield 3 chains of 8 letters each. It also follows that in the case of ah original primary com- 
ponent in which the total number of characters is a prime number, all decimation intervals will 
yield complete equivalent primary components. The following table has been drawn up in the 
ligh t t of these observations, for original primary sequences from 16 to 32 elements. (All prime- 
number sequences have been omitted ) In this table, the column at the extreme left gives the 
various decimation intervals, omitting in each case the first interval, which merely gives the 
original primary sequence, and the last interval, which merely gives the original sequence 
reversed. The top line of the table gives the various lengths of original primary sequences from 
32 down to 16. (The Btudent should bear m mind that sequences containing characters in addi- 
tion to the letters of the alphabet may be encountered; ho can add to this table when he is 
interested in sequences of more than 32 characters ) The numbers within the table then show, 
for each combination of decimation interval and length of, original sequence, the lengths of the 
chains of characters that can be constructed. (The student may note the symmetry in each 
column.) The bottom line shows the total number of complete equivalent primary components 
which can be derived for each different length of original component. 
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APPLICATION OF PRINCIPLES OF INDIRECT SYMMETRY OF POSITION 
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32. Applying the principles to a specific example. — a. The preceding section, with the 
many details covered, now forms a sufficient base for proceeding with an exposition of how the 
principles of indirect symmetry of position can be applied very early in the solution of a poly- 
alphabetic substitution cipher in which sliding primary components were employed to produce 
the secondary cipher alphabets for the enciphering of the cryptogram. 

b. The case described below will serve not only to explain the method of applying these 
principles but will at the same time show how their application greatly facilitates the solution 
of a single, rather difficult, polyalphabetic substitution cipher. It is realized, of course, that the 
cryptogram could be solved by the usual methods of frequency and long, patient experimentation. 
However, the method to be described was actually applied and very materially reduced the 
amount of time and labor that would otherwise have been required for solution. 

33. The cryptogram employed in the exposition. — a. The problem that will be used in this 
exposition involves an actual cryptogram submitted for solution in connection with a cipher 
device having two concentric disks upon which the same random mixed alphabet appears, both 
alphabets progressing in the same direction. This was obtained from a study of the descriptive 
circular accompanying the cryptogram. By the usual process of factoring, it was determined 
that the cryptogram involved 10 alphabets. The message as arranged according to its penod 
is shown in Figure 27, in which all repetitions of two or more letters are indicated. 

b. The tnliteral frequency distributions are given in Figure 28. It will be seen that on 
account of the brevity of the message, considering the number of alphabets involved, the fre- 
quency distributions do not yield many clues. By a very careful study of the repetitions, 
tentative individual determinations of values of cipher letters, as illustrated in Figures 29, 30, 
31, and 32, were made. These are given in sequence and in detail in order to show that there is 
nothing artificial or arbitrary in the preliminary stages of analysis here set forth. 

( 00 ) 
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The Cbyptogbam 





(Repetitions underlined) 




123454789 10 


123458789 10 


12348878810 


A ff FJJ P C F 0 C J Y 


P RCVOPNBLCW 


EE BKDZFMTGQJ 


B GBZDPFB OJJ 0 


Q LQZAAAMDCH 


FF LFJJYDTZV H Q 


C GRFTZMQMAV 


R BZZCKQOIKF_ 


GG ZGWNKXJTRN 


D KZUGDYFTRW 


S jCFBSCVXC H 0 


HH YTXCDPMVLW 


E G J-XNLff Y OUX 


T ZTZSDMXWCM 


II BGBffWOQRGN 


F I KJ? E P_S Z 0 K Z 


U RKUHEQEDGX 


JJ HHVLAQQV A_V 


G PRXDWLZICW 


V FKVHPJ JKJY 


KK JQffOOTTNVQ 


H GKQHOLODVM 


W YODPCJXLLL 


LL BKXDSOZRSN 


I GOXSNZHASE 


X GHXEROOPSE 


MM YUXOPPYOXZ 


J BBJIPQ. FJHD 


Y GKBWTLFDUZ 


NN _H 0 Z 0 W_M X_C G Q 


K QCBZEXQT X_Z 


Z OCDHWMZTUZ 


00 JJUGDWORVM 


L JCQRQFVMLH 


AA KLBPCJOTXE 


PP UKWPEFXENF 


M SRQEWMLNAE 


BB HSPOPNMDLM 


0 0. C C U G D W P E U H 


N GSXEROZJSE 


CC GCKWDVBLSE 


RR YBWEWVMDWJ 


OJJVQWEJMKGH 


DD GSUGDPOTHX 


SS R Z X 



817874 O - 43 - S 



Figure 27. 
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Tbilitekal Frequency Distributions 
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Initial Valuxs Fboic Assumptions 

13 8 I 

G,=Epj K«=Ep; X,=Ep; and D,=E„ from frequency considerations. 

148 4 88 9101 

UGD=THE; PCJ=THE; and SEG=THE, from study of repetitions. 
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Additional Values from Assumptions (I) 

9 

Refer to line DD in Figure 29; S« assumed to be Np. 

Refer to line M in figure 29; A, assumed to be ff*. 

• 10 i o< « s 

Then in lines C-D, AVKZUGD is assumed to be WITH THE. 



19940478910 

A WFUPCFOCJY 
T T H 

B GBZDPFB0U0 
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C GRFTZMQMAV 
E W I 

D K Z OGD Y F T R W 
T H T H E 
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EE 
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G PRXDWLZICW 
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Additional Values from Assumptions (II) 





Refer to Figure 30, line A;WFUPCF0CJ 
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Additional Values From Assumptions (III) 

4 5 6 

OPN — assume ING from repetition and frequency. 

9 10 1 

HQZ — assume ING from repetition and frequency. 
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e. From the initial and subsequent tentative identifications shown in Figures 29, 30, 31, 
and 32, the values obtained were arranged m the form of the secondary alphabets in a reconstruc- 
tion skeleton, shown in Figure 33. 



1 2 S 4 8 6 7 8 9 10 1] 12 18 14 18 18 17 IS IS 20 21 22 28 94 28 28 
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34. Fundamental theory. — a. In paragraph 31, methods of reconstructing primary com- 
ponents from secondary alphabets were given in detail. It is necessary that those methods be 
fully understood before the following steps be studied. It was there shown that the primary 
component can be one of a series of equivalent primary sequences, all of which will give exactly 
similar results so far as the secondary alphabets and the cryptographic text are concerned. 
It is not necessary that the identical or original primary component employed in the crypto- 
graphing be reconstructed, any equivalent primary sequence will serve. The whole question is 
one of establishing a sequence of letters the interval between which is either identical with that 
in the original primary component or else is an exact constant multiple of the interval separating 
the letters in the original primary component. For example, suppose K P X N Q forms a 
sequence in the original primary component. Here the interval between K and P, and P and X, 
XandN, N and Q is one, m an equivalent primary component, say the sequence K . . P . . X 
. . N . . Q, the interval between K and P is three, that between P and X also three, and so on; 
and the two sequences will yield the same secondary alphabets So long as the interval between 
K and P, P and X, X and N, N and Q, . . . , is a constant one, the sequence will be cryptographically 
equivalent to the original pnmary sequence and will yield the same secondary alphabets as do 
those of the original primary sequence. However, in the case of a 26-letter component, it is 
necessary that this interval be an odd number other than 13, as these are the only cases which 
will yield one unbroken sequence of 26 letters. Suppose a secondary alphabet to be as follows: 

.{Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

U '{Cipher. X KN P 
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It can be said that the primary component contains the following sequences: 



XN KP NQ PX 

These, when united by means of their common letters, yield K P X N Q. 

Suppose also the following secondary alphabet is at hand: 

.{Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ 

W [Cipher. P X K N 

Here the sequences PN, XQ, KX, and NZ can be obtained, which when united yield the two se- 
quences KXQ and PNZ. 

By a comparison of the sequences K P X N Q, K X Q, and PNZ, one can establish the 
following: 

KPXNQ 
K . X . Q 
P . N . Z 

It follows that one can now add the letter Z to the sequence, making it K P X N Q Z. 

b. The reconstruction of a primary component from one of the secondary alphabets by the 
process given in paragraph 31 requires a complete or nearly complete secondary alphabet. 
This is at hand only after a cryptogram has been completely solved. But if one could employ 
several very scant or skeletonized secondary alphabets simultaneously with the analysis of the 
cryptogram, one could then possibly build up a primary component from fewer data and thus 
solve the cryptogram much more rapidly than would otherwise be possible. 

c. Suppose only the cipher components of the two secondary alphabets (1) and (2) given 
above be placed into juxtaposition. Thus. 



1 3 I 4 St 7 8 8 10 U 13 18 14 15 IS 17 18 IB 2D 31 22 33 34 3S 36 



(1) X . K N P . . 

(2) P . . X K . N 



The sequences PX, XN, and KP are given by juxtaposition These, when united, yield KPXN 
as part of the primary sequence It follows, therefore, that one can employ the cipher components 
of secondary alphabets as sources of independent data to assist in building up the primary sequences. 
The usefulness of this pomt will become clearer subsequently. 

35. Application of principles . — a Refer now to the reconstruction skeleton shown in 
Figure 33 Hereafter, in order to avoid all ambiguity and for ease in reference, the position of 
a letter in Figure 33 will be indicated as stated in footnote 1, page 56 Thus, N (6-7) refers to 
the letter N in line 6 and in column 7 of Figure 33. 
b. (1) Now, consider the following pairs of letters: 



E (0-5) 
G (0-7) 
( 0 - 8 ) 
10 (0-15) 



J (6-5) 

N (6-7) 

0 (6-8) ) 
F (6-15)J 



HO, 0F=H0F 



(One is able to use the line marked zero in Figure 33 since this is a mixed sequence sliding against 
itself.) 
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(2) Tlie immediate results of this set of values will now be given. Having HOF as a sequence, 
with EJ as belonging to the same displacement interval, suppose HOF and EJ are placed into 
juxtaposition as portions of sliding components. Thus: 

Plain HOF... 

Cipher E J . . . . 

When Hp=E 0l then 0 P — J c 

(3) Refer now to alphabet 10, Figure 33, where it is seen that Hp— E e . The derived value , 
0 P = J e , can immediately be inserted in the same alphabet and substituted in the cryptogram. 

(4) The student may possibly get a clearer idea of the principles involved if he will regard 
the matter as though he were dealing with arithmetical proportion. For instance, given any 
three terms m the proportion 2:8=4:16, the 4th term can easily be found. Furthermore, given 
the pair of values on the left-hand side of the equation, one may find numerous pairs of 
values which may be inserted in the right-hand side, or vice versa. For instance, 2:8=4:16 
is the same as 2'8=5.20, or 9:36=4:16, and so on. An illustration of each of these principles 
will now be given, reference being made to Figure 33 As an example of the first principle, note 
that E (0-5) :H (0-8)=J (6-5):0 (6-8). Now find E (10-8):H (0-8)=? (10-15) :0 (0-15). 
It is clear that J may be inserted as the 3d term m this proportion, thus giving the 

i° 

important new value, 0 P = J„, which is exactly what was obtained directly above, by means of 
the partial sliding components. As an example of the second principle, note the following pairs: 

E (0-5) H (0-8) 

K (2-5) Z (2-8) 

D (5-5) C (5-8) 

J (6-5) 0 (6-8) 

These additional pairs are also noted: 

K (1-20) Z (1-7) 

T (0-20) G (0-7) 

Therefore, E:H=K:Z=D:C=J:0=T.G, and T may be inserted in position (4-5). 

e. (1) Again, GN belongs to the same set of displacement-interval values as do EJ and HOF. 
Hence, by superimposition- 

Plain HOF. . . 

Cipher . . . G N . . . . 

(2) Referring to alphabet 4, when H p =G e , then 0 P =N„ Therefore, the letter N can be inserted 

4 

in position (4-15) in Figure 33, and the value N e =0 p can be substituted in the cryptogram. 

(3) Furthermore, note the corroboration found from this particular superimposition: 

H (0-8) G (0-7) 

0 (6-8) N (6-7) 

This checks up the value in alphabet 6, G P =N„ 
d. (1) Again superimpose HOF and GN: 

• . .HOF. • . 

....GN... 

(2) Note this corroboration: 

0 (6-8) G (4-8) 

F (6-15) N (4-15) 

which has just been inserted in Figure 33, as stated above. 
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e. (1) Again using HOF and EJ, but in a different superimposition: 

. . .HOF. . 

..EJ.... 

(2) Refer now to H (9-9), J (9-8). Directly under these letters is found V (10-9), E (10-8). 

Therefore, the V can be added immediately before HOF, making the sequence V H 0 F. 
j. (1) Now take V H 0 F and juxtapose it with E J, thus. 

. . . V H 0 F . . . 

...EJ... 

(2) Refer now to Figure 33, and find the following: 

V (10-9) E (10-8) 

H (9-9) J (9-8) 

0 (4-9) G (4—8) 

1 (0-9) H (0-8) 

(3) From the value 0 G it follows that G can be set next to J in E J. Thus: 

. . . V H 0 F . . . 

. . . E J G . • • 

(4) But G N already is known to belong to the same set of displacement-interval values 
as E J. Therefore, it is now possible to combine E J, J G, and G N into one sequence, E J GN, 
yielding: 

. . . V H 0 F , . . 

. E J G N . • 

g. (1) Refer now to Figure 33. 

V (0-22) E (0-5) 

? (1-22) G (1-5) 

? (2-22) K (2-5) 

? (3-22) X (3-5) 

? (5-22) D (5-5) 

? (6-22) J (6-5) 

(2) The only values which can be inserted are: 

0 (1-22) G (1-5) 

H (6-22) J (6-5) 

(3) This means that V P =0 S in alphabet 1 and that V„=H e in alphabet 6. There is one 0, 
in the frequency distribution for alphabet 1, and no H, in that for alphabet 6. The frequency 
distribution is, therefore, corroborative insofar as these values are concerned. 

(A) (1) Further, taking E J G N and V H. 0 F, superimpose them thus: 

. . . E J G N . . . 

. . . V H 0 F . . . 

(2) Refer now to Figure 33. 

E (0-5) H (0-8) 

G (1-5) ? (1-8) 
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(3) From the diagram of superimposition the value 6 (1-5) F (1-8) can be inserted, which 
gives H p =F e in alphabet 1. 

t. (1) Again, V H 0 F and E J G N are juxtaposed: 

. . . V H 0 F . . . 

• . . E J G N . . • 

(2) Refer to Figure 33 and find the following: 

H (0-8) G (4-8) 

A (0-1) E (4-1) 

This means that it is possible to add A, thus: 

. . . A V H 0 F . . . 

• ■ . E J G N . i • 

(3) In the set there are also: 

E (0-5) G (1-5) 

G (0-7) Z (1-7) 

Then in the superimposition 

• . • E J G N • • • 

• • < E J G N > • > 



It is possible to add Z under G, making the sequence E J G N Z. 
(4) Then taking 



. . . A V H 0 F . . . 

• • ■ E J G N Z * • 9 



and referring to Figure 33: 

H (0-8) N (0-14) 

0 (6-8) 7 (6-14) 

It will be seen that 0=Z from superimposition, and hence in alphabet 6 N P =Z„ an important 
new value, but occurring only once in the cryptogram. Has an error been made? The work 
so far seems too corroborative in interlocking details to think so. 

j. (1) The possibilities of the superimposition and sliding of the AVHOF and the EJGNZ 
sequences have by no means been exhausted as yet, but a little different trail this time may 
be advisable. 



E (0-5) 


T (0-20) 


G (1-5) 


K (1-20) 


X (3-5) 


U (3-20) 


(2) Then: 




. • • E «7 


GNZ . . 


. . . T . 


K . . . 


(3) Now refer to the following: 




E (0-5) 


K (2-5) 


N (0-14) 


S (2-14) 
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whereupon the value S can be inserted: 

• • < E J G N Z • • • 

. . . T . K . ■ S ■ . • 

k. (1) Consider all the values based upon the displacement interval corresponding to JG: 

J (6-5) G (1-5)-* J (9- 8) G (4- 8) 

N (6-7) Z (1-7) H (9- 9) 0 (4- 9) 

S (9-20) P (4-20)-* S (2-14) P (5-14) 

Z (2- 8) C (6- 8) 

K (2- 5) D (5- 5) 

(2) Since J and G are sequent in the E J G N Z sequence, it can be said that all the letters 
of the foregoing pairs are also sequent. Hence Z C, S P, and K D are available as new data. 
These give E J G N Z C and T . X D . S P. 

(3) Now consider: 

T (0-20) P (4-20) 

A (0- 1) E (4- 1) 

H (0- 8) G (4- 8) 

I (0- 9) 0 (4- 9) 

1 3 S 4 5 • 

Now in the T . K D . S P sequence the interval between T and P is T P. 

Hence the interval between A and E is 6 also. It follows therefore that the sequences A V H 0 F 
and E J G N Z C should be united, thus: 

i a a 4 a a 

. . . AVHOF . EJGNZC . . . 

(4) Corroboration is found in the interval between H and G, which is also six. The letter I 
can be placed into position, from the relation I (0-9) 0 (4-9), thus: 

1 3 3 4 (4 

. . .1. .AVHOF. EJGNZC. . . 

l. (1) From Figure 33: 

H (0- 8) Z (2- 8) 

E (0- 5) K (2- 5) 

N (0-14) S (2-14) 

U (0-21) F (2-21) 

(2) Since in the I . . AVHOF . EJGNZC sequence the letters H and Z are separated 
by 8 intervals one can write. 

l a s 4 ( e r s 

. . . H Z . . . 

. . . E K . . . 

. . . N S . . . 

. . , U F . . . 
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(3) Hence one can make the sequence 

1 3 8 4 6 6 7 8 

. . .1. . AVHOF . EJGNZC . . K . . . 

Then .. .1. . AVHOF. EJGNZCT.KD.SP. 

and . . HI . . AVHOF. EJGNZCT.KD.SP. 

13846678 13846678 

m (1) Subsequent derivations can be indicated very briefly as follows: 

E (0-5) C (0-3) 

D (5-5) R (5-3) 

1 3 I 4 1 6 7 8 9 16 11 13 It 14 11 16 17 18 13 X 31 23 28 34 38 36 

From 0 1. .AVHOF. EJGNZCT.KD.SP. . . 
one can write ... E .... C .. . 

1 3 8 4 8 

and . . . D . . , 



making the sequence 



13 8 4 



R 



1 3 8 4 6 6 7 8 9 10 11 12 13 14 18 1* 17 18 19 30 21 22 23 34 24 38 

U I . . AVHOF. EJGNZCT.KD.SP.R. 



T (0-20) 
E (0- 5) 



(2) Another derivation: 

U (3-20) 

X (3- 5) 

1 3 8 4 6 6 7 8 9 10 11 13 13 14 IS 18 17 18 19 20 21 22 23 34 28 38 

From 0 1. .AVHOF. EJGNZCT.KD.SP.R. 
one can write 

01 T... 

and E . . . . 



X 



making the sequence 

1 3 8 4 5 6 7 8 9 10 11 13 13 14 It 18 17 18 19 20 31 23 23 34 28 36 

U I . . AVHOF. EJGNZCT.KDXSP.R. 

(3) Another derivation: 

E (0-5) G (1-5) 

B (0-2) ff (1-2) 

From . . . E J G . . . 

one can write . . . E . G . . . 

and then . . . B . W . . . 

There is only one place where B . W can fit, vis, at the end 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 IS 18 17 18 19 20 21 22 23 24 28 26 

U I . . AVHOF. EJGNZCT.KDXSPBRW 



7i. Only four letters remain to be placed into the sequence, ms, L, M, Q, and 
positions are easily found by application of the primary component to the message, 
plete sequence is as follows: 

1 2 3 4 8 6 7 8 9 10 11 12 13 14 18 16 17 18 19 20 21 22 23 24 28 38 

UIMYAVHOFLEJGNZCTQKDXSPBRW 



Y. Their 
The com- 
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Having the primary component fully constructed, 


decipherment of the cryptogram 


can be 


completed with speed and precision. 


The text 


is as 


follows: 
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FlOUKE 34. 



























o. The primary component appears to be a random-mixed sequence; no key word is to be 
found, at least none reappears on experimentation with various hypotheses as to enciphering 
equations. Nevertheless, the random construction of the primary component did not compli- 
cate or retard the solution. 
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p. Some students may prefer to work exclusively with the reconstruction skeleton, rather 
than «ith sliding strips. One method is as good as the other and personal preferences will dictate 
which will be used by the individual student. If the reconstruction skeleton is used, the original 
letters should be inserted in mk, so as to differentiate them from derived letters. 

36. General remarks. — a. It is to be stated that the sequence of steps described in the 
preceding paragraphs corresponds quite closely with that actually followed m solving the prob- 
lem. It is also to be pointed out that this method can be used as a control in the early stages 
of analysis because it will allow the cryptanalyst to check assumptions for values. For example, 
the very first value derived m applying the principles of indirect symmetry to the problem 
herein described was H e =A p in alphabet 1. As a matter of fact the writer had been inclined 
toward this value, from a study of the frequency and combinations which H s showed; when the 
indirect-symmetry method actually substantiated his tentative hypothesis he immediately 
proceeded to substitute the value given If he had assigned a different value to H„, or if he had 
assumed a letter other than H e for A p in that alphabet, the conclusion would immediately follow 
that either the assumed value for H, was erroneous, or that one of the values which led to the 
derivation of H,=A P by indirect symmetry was wrong. Thus, these principles aid not only in 
the systematic and nearly automatic derivation of new values (with only occasional, or incidental 
references to the actual frequencies of letters), but they also assist very materially m serving as 
corroborative checks upon the validity of the assumptions already made. 

b. Furthermore, while the writer has set forth, in the reconstruction skeleton in Figure 33, 
a set of 30 values apparently obtained before he began to reconstruct the primary component, 
this was done for purposes of clarity and brevity in exposition of the principles herein described. 
As a matter of fact, what he did was to watch very carefully, when inserting values in the recon- 
struction skeleton to find the very first chance to employ the principles of indirect symmetry; 
and just as soon as a value could be derived, he substituted the value in the cryptographic text. 
This is good procedure for two reasons Not only will it disclose impossible combinations but 
also it gives opportunity for making further assumptions for values by the addition of the derived 
values to those previously assumed Thus, the processes of reconstructing the primary com- 
ponent and finding additional data for the reconstruction proceed simultaneously in an ever- 
widening circle. 

c It is worth noting that the careful analysis of only 30 cipher equivalents in the recon- 
struction skeleton shown in Figure 33 results in the derivation of the entire table of secondary 
alphabets, 676 values in all. And while the elucidation of the method seems long and tedious, in 
its actual application the results are speedy, accurate, and gratifying in their corroborative effect 
upon the mental activity of the cryptanalyst. 

d. (1) The problem here used as an illustrative case is by no means one that most favorably 
presents the application and the value of the method, for it has been applied in other cases with 
much speedier success For example, suppose that in a cryptogram of 6 alphabets the equivalents 
of only THE in all 6 alphabets are fairly certain. As in the previous case, it is supposed that the 
secondary alphabets are obtained by sliding a mixed alphabet against itself. Suppose the sec- 
ondary alphabets to be as follows: 
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0 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


U 


N 
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T 
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V 


W 


X 


Y 
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1 










B 
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V 
























c 












■ 


4 










N 
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P 
























B 
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5 










X 






0 
























P 














6 










T 






Z 
























V 















JTlOUUU 



(2) Consider the following chain of derivatives arranged diagrammatically: 
H (0- 8) 0 (5- 8) 



T (0-20) P (5-20) 

E (0- 5) X (5- 5)-»E (1-20) 
Q (1- 8) 

B (1- 5) 



*P (5-20) V (6-20) 

0 (5- 8) Z (6- 8) 

X (5- 5) T (6- 5)-»X (2-20) 
L (2- 8) 
C (2- 5) 



X (2-20) 

L (2- 8) 

C (2- 5)-»B (4-20) 
N (4- 5) 
P (4- 8) 



T (0-20) 
H (0- 8) 
E (0- 5)- 



>C 

V 

I 



C 

I 

V 



(3-20) 
(3- 8) 
(3- 5) 



(3-20) 
(3- 5) 
(3- 8)- 



E (1-20) 

Q (1- 8) 

B (1- 5) 



FlQU&E SO 



(3) These pairs manifestly all belong to the same displacement interval, and therefore 
unions can be made immediately. The complete list is as follows: 

EX, Q L, N I, L H, H 0. B C, 0 Z, C E, TP, P V, X T, V Q, IB 

(4) Joining pairs by their common letters, the following sequence is obtained: 

. . . NIBCEXTPVQLHOZ . . . 



e With this as a nucleus the cryptogram can be solved speedily and accurately. When 
it is realized that the cryptanalyst can assume THE’s rather readily in some cases, the value of 
this principle becomes apparent When it is further realized that if a cryptogram haB sufficient 
text to enable the THE’s to be found easily, it is usually also not at all difficult to make correct 
assumptions of values for two or three other high-frequency letters, it is clear that the principles 
of indirect symmetry of position may often be used with gratifyingly quick success to reconstruct 
the complete primary component 

/. When the probable-word method is combined with the principles of indirect symmetry 
the solution of a difficult case is often accomplished with astonishing ease and rapidity. 

517974 0 - 45 -8 
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Section IX 

REPEATING-KEY SYSTEMS WITH MIXED CIPHER ALPHABETS, HI 

Fmgrmph 

Solution of messages enciphered by known primary components 37 

Solution of repeating-key ciphers in which the identical mixed components proceed in opposite directions.- 38 

Solution of repeating-key ciphers in which the primary components are different mixed sequences 39 

Solution of subsequent messages after the primary components have been recovered 40 

37. Solution of subsequent messages enciphered by the same primary components. — a. In 
the discussion of the methods of solving repeating-key ciphers using secondary alphabets derived 
from the sliding of a mixed component against the normal component (Section V), it was shown 
how subsequent messages enciphered by the same pair of primary components but with different 
keys could be solved by application of principles involving the completion of the plain-component 
sequence (paragraphs 23, 24) The present paragraph deals with the application of these Bame 
principles to the case where the primary components are identical mixed sequences. 

b. Suppose that the following primary component has been reconstructed from the analysis 
of a lengthy cryptogram: 

QUESTIONABLYCDFGHJKMPRVWXZ 

A new message exchanged between the same correspondents is intercepted and is suspected 
of having been enciphered by the same primary components but with a different key. The 
message is as follows. 

NFD ff P N 0 M K I W_P I D S C A A E T Q V Z S E 

Y 0 J SC A A A F G R V N H D ff D S C A E G N F P 

FOEMT HXLJff PNOMK I QDBJ I V N H L 

TFNCS BGCRP 

c Factoring discloses that the period is 7 letters The text is transcribed accordingly, and 
is as follows: 

N F W W P N 0 

M K I W P I D 

S C A A E T Q 

V Z S E Y 0 J 

S C A A A F G 

RVNHDID 
S C A E G N F 
PFOEMTH 
X L J W P N 0 
HKIQDBJ 
I V N H L T F 

N C S B G C R 

P 

Florae 87 

(78) 
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d. The letters belonging to the same alphabet are then employed aa the initial letters of 
completion sequences, in the manner shown in paragraph 23e, using the already reconstructed 
primary component. The completion diagrams for the first five letters of the first three alphabets 
are as follows: 



Altbabh 1 

HMSYS 
A P T W T 
B R I X I 
L V 0 Z 0 

Y W N Q N 
C X A U A 
D Z B E B 
FQLSL 
G U Y T Y 

*H E C I C 
J S D 0 D 
KTFKF 
M I G A G 
P 0 H B H 
RNJLJ 

V A K Y K 
W B M C M 
X L P D P 
ZYRFR 
Q C V G V 
U D W H V 
E F X J X 
S G Z K Z 
T H Q M Q 
I JUPU 
OKERE 



Alphabet a 

F K C Z C 
GUDQD 
HPFDF 
JRGEG 
K V H S H 

M W J T J 

P X K I K 

RZUOM 

V Q P N P 

W U R A R 

X E V B V 

ZSIfLH 
Q T X Y X 

U I Z C Z 

E 0 Q D Q 

S N U F U 

T A E G E 

I B S H S 

0 L T J T 

N Y I K I 

*A C 0 M 0 

B D N P N 

L F A R A 

Y G B V B 

C H L W L 

D J Y X Y 

Fioore 38, 



Alphabet l 

W I A S A 
X 0 B T B 
Z N L I L 
Q A Y 0 Y 
UBCNC 
E L D A D 
5 Y F B F 
T C G L G 
I D H Y H 
0 F J C J 
N G K D K 
A H M F M 
B J P G P 
L K R H R 
YHVSV 
CPWKS 
DRXHX 
F V Z P Z 
G W Q R Q 
H X U V U 
JZEVE 
K Q S X X 
HUTZT 
PE1QI 
R S 0 U 0 
*V T N E N 



e Examining the successive generatracies to select the ones showing the best assortment of 
high-frequency letters, those marked in Figure 38 by asterisks are chosen These are then assem- 
bled in columnar fashion and yield the following plain text* 



H A V 
E C T 
CON 
I M E 
CON 



irnun. 
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j. The corresponding key-letters are sought, using enciphering equations 0k/ t =©i/»; 6p/i= 
0 o/e , and are found to be JOU, which suggests the keyword JOURNEY. Testing the key-letters 
RNEY for alphabets 4, 5, 6, and 7, the following results are obtained: 

i » s 4 s e r 
JOURNEY 
NFUPNO 
H A V E D I R 

M K I W P I D 
E C T E D S E 

IMtnaei. 

The message may now be completed with ease. It is as follows: 



JOURNEY 
H A V E D I R 
N F W W P N 0 

E C T E D S E 
M K I W P I D 

C 0 N D R E G 
SCAAETQ 

IHENTTO 
V Z S E Y 0 J 

CONDUCT 
S C A A A F G 

T H 0 R 0 R E 
R V N H D W D 

C 0 N N A I S 
S C A E G N F 



JOURNEY 
S A I N C E I 
PFOEHTH 

N T H E D I R 
X L J V P N 0 

E C T I 0 N 0 
HKIQDBJ 

F H 0 R S E S 
I V N H L T F 

H 0 E F A L L 
N C S B G C R 

S 

P 



FioubiU. 



38. Solution of repeating-key ciphers in which the identical mixed components proceed in 
opposite directions. — The secondary alphabets m this case (paragraph 6, Case B (3) (a) (II) 
are reciprocal. The steps in solution are essentially the same as in the preceding case (para- 
graph 28); the principles of indirect symmetiy of position can also be applied with the necessary 
modifications introduced by virtue of the reciprocity existing within the respective secondary 
alphabets (paragraph 31p). 

39. Solution of repeating-key ciphers in which the primary components are different mixed 
sequences. — This is Case B (3) (b) of paragraph 6. The steps in solution are essentially the same 
as m paragraphs 28 and 31, except that in applying the principles of indirect symmetry of posi- 
tion it is necessary to take cognizance of the fact that the primary components are different 
mixed sequences (paragraph 31g). 

40. Solution of subsequent messages after the primary components have been recovered. — 
a. In the case in which the primary components are identical mixed sequences proceeding in 
opposite directions, as well as in that in which the primary components are different mixed 
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sequences, the solution of subsequent messages 1 is a relatively easy matter. In both cases, how- 
ever, the student must remember that before the method illustrated in paragraph 37 can be 
applied it is necessary to convert the cipher letters into their plain-component equivalents 
before completing the plain-component sequence. From there on, the process of selecting and 
assembling the proper generatrices is the same as usual. 

b. Perhaps an example may be advisable. Suppose the enemy has been found to be using 
primary components based upon the keyword QUESTIONABLY, the plain component running 
from left to right, the cipher component in the reverse direction. The following new message 
has arrived from the intercept station: 



M V X 0 X 


B Z I Y Z 


NLVZH 


0 X I E 0 


0 0 E P Z 


FXSRX 


E J B S H 


B 0 N A U_ 


R A P Z I 


N R_A M V 


X 0 X A I 


J Y X W F 


ENDOW 


J E R C U 


R A L V B 


Z A Q U W 


J W X Y I 


DGRKD 


QBDRU 


Q E C Y V 



Q V 



1 S I 4 5 8 

HYZOXB 
Z I Y Z N L 
W Z H 0 X I 
E 0 0 0 E P 
Z F X S R X 
E J B S H B 

0 N A U R A 
P Z I N R A 
M V X 0 X A 

1 J Y X W F 
K N D 0 V J 
ERCURA 
L V B Z A Q 
U W J W X Y 
ID6RKD 
QBDRHQ 
E C Y V Q W 



e. Factoring discloses that the period is 6 and the mes- 
sage is accordingly transcribed into 6 columns, Fig 42. 
The letters of these columns are then converted into their 
plain component equivalents by juxtaposing the two pri- 
mary components at any point of coincidence, for ex- 
ample Qp=Z a . The converted letters are shown in Fig. 43. 
The letters of the individual columns are then used as the 
initial letters of completion sequences, using the 
QUESTIONABLY primary sequence. The final step is the 
selection and assembling of the selected generatrices. 
The results for the first ten letters of the first three columns 
are shown below: 



i a » « 5 a 
OSUMUH 
Q P F Q K 6 
EQBHUP 
W U M M W I 
Q Y U V T U 
W A H V B H 
M K J X T J 
I Q P K T J 
OSUUU J 
P A F U E Y 
N K C M E A 
W T D X T J 
6 S H Q J Z 
X E A E U F 
P C L T N C 
Z H C T 0 Z 
W D F S Z E 



nocu a 



Fioum a 



1 That u, messages intercepted after the primary components have been reconstructed and enciphered by 
keys different from those used in the messages upon which the reconstruction of the primary components was 
accomplished. 
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Oounoi 1 Counci 3 Oounm I 

OQEWQWMIOP SPQMYAKQSA UFBMUHJPUF 

NUSXUXPONR TRUPCBMUTB EGLPEJKREG 

AETZEZRNAV *IVERDLPEIL SHYRSKMVSH 

BSIQSQVABW OWSVFYRSOY TJCVTMPWTJ 

LTOUTUWBLX NXTWGCVTNC IKDWIPRXIK 

YINEIEXLYZ AZIXHDWIAD OMFXORVZOM 

COASOSZYCQ BQOZJFXOBF NPGZNVWQNP 

DNBTNTQCDU LUNQKGZNLG ARHQAWXUAR 

•FALIAIUDFE YEAUMHQAYH BVJUBXZEBV 

GBYOBOEFGS CSBEPJUBCJ LWKELZQSLW 

HLCNLNSGHT DTLSRKELDK YXMSYQUTYX 

JYDAYATHJI FIYTVMSYFM CZPTCUEICZ 

KCFBCBI JKO GOCIWPTCGP DQRIDESODQ 

MDGLDLOKMN HNDOXRIDHR FUVOFSTNFU 

PFHYFYNMPA JAFNZVOFJV GEWNGTIAGE 

RGJ CGCAPRB KBGAQWNGKW HSXAHIOBHS 

VHKDHDBRVL MLHBUXAHMX JTZBJONLJT 

WJMFJFLVWY PYJLEZBJPZ KIQLKNAYKI 

XKPGKGYVXC RCKYSQLKRQ MOUYMABCMO 

ZMRHMHCXZD VDMCTUYMVU PNECPBLDPN 

QPVJPJDZQF WFPDIECPWE *RASDRLYFRA 

URWKRKFQUG XGRFOSDRXS VBTFVYCGVB 

EVXMVMGUEH ZHVGNTFVZT WLIGWCDHWL 

SWZPWPHESJ QJWHAIGWOI XYOHXDFJXY 

TXQRSRJSTK UKXJBOHXUO ZCNJZFGKZC 

IZUVZVKTIM EMZKLNJZEN QDAKQGHNQD 

nous* 44. 

Columnar assembling of selected generatrices gives what is shown in Fig 45. 



1 3 3 4 5 6 



FIR. 




A V A . 




L E S . 




I R D . 




ADR. 




ILL. 




U P Y . 




D E F . 




FIR. 




E L A . 





FlOUV 45. 
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d. The key letters are sought, and found to be NUM, which suggests NUMBER. The entire 
message may now be read with ease. It is as follows: 



NUMBER 


NUMBER 


F I R S T C 


E L A Y I N 


11 V X 0 X B 


I J Y X W F 


A V A L R Y 


G P 0 S I T 


Z I Y Z N L 


K N D 0 V J 


L E S S T H 


I 0 N A N D 


V Z H 0 X I 


E R C U R A 


I R D S Q U 


W I L L P R 


E 0 0 0 E P 


LVBZAQ 


A D R 0 N W 


0 T E C T L 


Z F X S R X 


U W J W X Y 


I L L 0 C C 


E F T F L A 


E J B S H B 


I D G R K D 


U P Y A N D 


N K 0 F B R 


0 N A U R A 


Q B D R M Q 


DEFEND 


I G A D E X 


P Z I N R A 


E C Y V Q W 


F I R S T D 




M V X 0 X A 





FJGCTIX 48. 

0 . If the primary components are different mixed sequences, the procedure is identical with 
that just indicated. The important point to note is that one must not fail to convert the letters 
into their plain-component equivalents before the completion-sequence method is applied 
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Section X 

REPEATING-KEY SYSTEMS WITH MIXED CIPHER ALPHABETS, IV 

Paragraph 



General remarks 41 

Denying the secondary alphabets, the primary components, and the key, given a cryptogram with its 

plain text 42 

Deriving the secondary alphabets, the primary components, and the keywords for messages, given two or 

more cryptograms m different keys and suspected to contain identical plain text 43 

The case of repeating-key systems.... 44 

The case of identical messages enciphered by keywords of different lengths 45 

Concluding remarks 46 



41. General remarks. — The preceding three sections have been devoted to an elucidation 
of the general principles and procedure m the solution of typical cases of repeating-key ciphers. 
This section will be devoted to a consideration of the variations in cryptanalytic procedure arising 
from special circumstances. It may be well to add that by the designation “special circum- 
stances’’ it is not meant to imply that the latter are necessarily unusual circumstances. The 
student should always be on the alert to seize upon any opportunities that may appear in which he may 
apply the methods to be described In practical work such opportunities are by no means rare and 
are seldom overlooked by competent cryptanalysts. 

42. Deriving the secondary alphabets, the primary components, and the key, given a 
cryptogram with its plain text. — a. It may happen that a cryptogram and its equivalent plain 
text are at hand, as the result of capture, pilferage, compromise, etc This, as a general rule, 
affords a very easy attack upon the whole system. 

b. Taking first the case where the plain component is the normal alphabet, the cipher com- 
ponent a mixed sequence, the first thing to do is to write out the cipher text with its letter-for- 
letter decipherment From this, by a slight modification of the principles of “factoring”, one dis- 
covers the length of the key. It is obvious that when a word of three or four letters is enciphered 
by the same cipher text, the interval between the two occurrences is almost certainly a multiple 
of the length of the key. By noting a few recurrences of plain text and cipher letters, one can 
quickly determine the length of the key (assuming of course that the message is long enough to 
afford sufficient data). Having determined the length of the key, the message is rewritten accord- 
ing to its periods, with the plain text likewise in periods under the cipher letters. From this 
arrangement one can now reconstruct complete or partial secondary alphabets. If the secondary 
alphabets are complete, they will show direct symmetry of position; if they are but fragmentary 
in several alphabets, then the primary component can be reconstructed by the application of the 
principles of direct symmetry of position 

c If the plain component is a mixed sequence, and the cipher component the normal (direct or 
reversed sequence), the secondary alphabets will show no direct symmetry unless they are ar- 
ranged in the form of deciphering alphabets (that is. A, ... Z, above the zero line, with their 
equivalents below). The student should be on the lookout for such cases. 

d. (1) If the plain and cipher primary components are identical mixed sequences proceeding 
in the same direction, the secondary alphabets will show indirect symmetry of position, and they 
can be used for the speedy reconstruction of the primary components (Paragraph 31a to o). 

( 84 ) 
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(2) If the plain and the cipher primary components are identical mixed sequences proceeding 
in opposite directions, the secondary alphabets will be completely reciprocal secondary alphabets 
and the primary component may be reconstructed by applying the principles outlined in para- 
graph 31 p. 

(3) If the plain and the cipher primary components are different mixed sequences, the 
secondary alphabets will show indirect symmetry of position and the primary components may 
be reconstructed by applying the principles outlined in paragraph 31g. 

a. In all the foregoing cases, after the primary components have been reconstructed, the 
keys can be readily recovered. 

43. Deriving the secondary alphabets, the primary components, and the keywords for 
messages, given two or more cryptograms in different keys and suspected to contain identical 
plain text. — a. The simplest case of this kind iB that involving two monoalphabetic substitution 
ciphers with mixed alphabets derived from the some pair of sliding components. An understand- 
ing of this case is necessary to that of the case involving repeating-key ciphers. 

b. (1) A message is transmitted f rom station A to station B. B then sends A some operating 
signals which indicate that B c ann ot decipher the message, and soon thereafter A sends a second 
message, identical in length with the first. This leads to the suspicion that the plain text of both 
messages is the same. The intercepted messages are superimposed. Thus: 

1. NXGRV MPUOF ZQVCP VWERX QDZVX WXZQE TBDSP WXJK RFZWH ZUWLU IYVZQ FXOAR 

2. EMLHJ FGVUB PRJNG JKWHM RAPJM KMPRff ZTAXG JJMCD HBPKY PVKIV QOJPR BMUSH 

(2) Initiating a chain of cipher-text equivalents from message 1 to message 2, the following 
complete sequence is obtained: 

1 2 8 4 8 « 7 8 810 11 1218 14 18 18 17 18 19 20 21 22 28 24 28 28 

NEWKDASXMFBTZPGLIQRHYOUVJ C 

(3) Experimentation along already-indicated lines soon discloses the fact that the foregoing 
component is an equivalent primary component of the original primary based upon the keyword 
QUESTIONABLY, decimated on the 21st interval. Let the Btudent decipher the cryptogram 

(4) The foregoing example is somewhat artificial in that the plain text was consciously 
selected with a view to making it contain every letter of the alphabet The purpose in doing 
this was to permit the construction of a complete chain of equivalents from only two short 
messages, in order to give a simple illustration of the principles involved. If the plain-text message 
does not contain every letter of the alphabet, then only partial chains of equivalents can be con- 
structed. These may be united, if circumstances will permit, by recourse to the various prin- 
ciples elucidated in paragraph 31. 

(5) The student should carefully study the foregoing example in order to obtain a thorough 
comprehension of the reason why it was possible to reconstruct the primary component from the 
two cipher messages without having any plain text to begin with at all. Since the plain text of 
both messages is the same, the relative displacement of the primary components in the case of 
message 1 differs from the relative displacement of the same primary components in the case of 
message 2 by a fixed interval. Therefore, the distance between N and E (the first letters of the 
two messages), on the primary component, regardless of what plain-text letter these two 
cipher letters represent, is the same as the distance between E and W (the 18th letters), V and K 
(the 17th letters), and so on. Thus, this fixed interval permits of establishing a complete chain 
of letters separated by constant intervals and this chain becomes an equivalent primary com- 
ponent. 
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44. The case of repeating-key systems. — a. With the foregoing basic principles in mind 
the student is ready to note the procedure in the case of two repeating-key ciphers having identical 
plain texts First, the case in which both messages have keywords of identical length but different 
compositions will be studied. 

b. (1) Given the following two cryptograms suspected to contain the same plain text: 



Y H Y E X 
PCQTU 
T R 0 Q S 



C G S L Z 
M T A I Q 
V S N Z R 



U B U K A 
HGKFA 
U H A F K 



QUBHN 
ZWUDQ 
B J N 0 Q 



Message 1 

P V L L T 
Z E F I Z 

Message 2 

C T Y B V 
N S D W N 



A B U V V 
B D J E Z 



H L Q F T 
L C B L Q 



D Y S A B 
A L V I D 



F L R H L 
N E T 0 C 



(2) The first step is to try to determine the length of the period. The usual method of 
factoring cannot be employed because there are no long repetitions and not enough repetitions 
even of digraphs to give any convincing indications. However, a subterfuge will be employed, 
based upon the theory of factoring. 



c. (1) Let the two messages be superimposed. 





i 


3 


3 


4 


8 


« 


i 


8 


• 


10 


u 


12 


13 


14 


18 


13 


IT 


18 


19 


20 


1. 


Y 


H 
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E 


X 


u 


B 


U 


K 


A 


P 


V 


L 


L 


T 


A 


B 


0 


V 


V 
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C 


G 
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L 
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M 
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C 


T 


Y 


B 


V 


H 


L 


Q 


F 


T 
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23 
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28 


29 


10 


31 


32 


33 


84 


36 


36 


37 


38 


30 
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D 


Y 
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L 


M 


m 
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A 


I 


Q 


z 


W 


M 


D 


Q 


N 


s 


D 


ff 


N 




41 


42 
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46 


47 


48 
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60 


61 


62 


63 


64 


66 


66 


a 


68 


69 


60 


1. 


B 


D 


J 


E 


z 


A 


L 


V 


I 


D 


T 


R 


0 


Q 


s 


u 


H 


A 


F 


K 


2. 


L 


C 


B 


L 


Q 


N 


E 


T 


0 


C 


V 


S 


N 


z 


R 


B 


J 


N 


0 


Q 
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E E 

(2) Now let a search be made of cases of identical Buperimposition. For example, L and L 
< u so 

u u u 

are separated by 40 letters, Q, Q, and Q are separated by 12 letters. Let these intervals between 
identical supenmpositions be factored, just as though they were ordinary repetitions That 
factor which is the most frequent should correspond with the length of the period for the following 
reason. If the period is the same and the plain text is the same in both messages, then the con- 
dition of identity of superimposition can only be the result of identity of encipherments by 
identical cipher alphabets. This is only another way of saying that the same relative position in 
the keying cycle has been reached in both cases of identity. Therefore, the distance between 
identical superimpositions must be either equal to or else a multiple of the length of the period. 
Hence, factoring the intervals must yield the length of the period. The complete list of intervals 
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and factors applicable to cases of identical superimposed pairs is as follows (factors above 12 
ore omitted): 



Repetition 


2 


Factors 


Repetition 


Interval 


Factors 


1st EL to 2d EL 


40 


2, 4, 6, 8, 10. 


1st TV to 2d TV 




2, 3. 4. 6. 9. 12 


1st uq to 2d uq 


12 


2, 3, 4, 6, 12. 


1st AH to 2d AH_ 




2, 4, 8. 


2 d nq to ad uq 


12 


2, 3, 4, 6, 12. 


1st BL to 2d BL 


riflrfl 


2, 4, 8 


1st UB to 2d UB 


48 


2, 8, 4, 6, 8, 12 


2d BL to 3d BL .... 


16 


2, 4, 8 


1st KM to 2d KM 


24 


2, 3, 4. 6, 8, 12. 


1st SR to 2d SR 




2, 4, 8. 


1st AN to 2d AN 


36 


2, 3, 4, 6, 0, 12 


1st FD to 2d FT) 




2, 4 


2d AN to 3d AN 


12 


2, 3, 4, 6, 12. 


1st ZN to 2d ZN. 




2,4. 


1st VT to 2d VT 


8 


2, 4, 8. 


1st DC to 2d DC.. 


8 


2, 4, 8. 


2d VT to 3d VT. 


28 


2, 4, 7. 





(3) The factors 4 and 2 are the only ones common to every one of these intervals and since a 
period of 2 is not very probable it may be taken as beyond question that the length of the period is 4. 



d. Let the messages now be superimposed according to their periods. 





13 3 4 


13 3 4 


13 14 


13 3 4 


13 3 4 


13 3 4 


13 3 4 


1 . 


Y H Y E 


X U B U 


K A P V 


L L T A 


B U V V 


D Y S A 


B P C Q 


2. 


C G S L 


Z Q U B 


M N C T 


Y B V H 


L Q F T 


F L R H 


L M T A 


1 . 


TUNG 


K F A Z 


E F I Z 


B D J E 


Z A L V 


I D T R 


0 Q S U 


2. 


I Q Z W 


M D Q N 


S D V N 


L C B L 


Q N E T 


0 C V S 


N Z R B 



1. H A F K 

2. J N 0 Q 

e. (1) Now distribute the superimposed letters into a reconstruction skeleton of “secondary 
alphabets ” 

Thus: 



0 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


s 


T 


U 


V 


W 


X 


Y 


z 


1 




L 




F 


S 






J 


0 




M 


Y 






N 










I 








z 


C 


Q 


2 


N 






C 




D 




G 








B 








M 


z 








Q 








L 




8 


Q 


U 


T 






0 






w 


B 




E 




Z 




C 






R 


V 




F 






S 




4 


H 








L 




W 








Q 












A 


S 






B 


T 








N 



(2) By the usual methods, construct the primary or an equivalent primary component. 
Taking lines 0 and 1, the following sequences are noted: 

BL, DF, ES, HJ, 10, KM, LY, ON, TI, XZ, YC, ZQ. 

which, when united by means of common letters and study of other sequences, yield the complete 
original primary component based upon the keyword QUESTIONABLY : 

QUESTIONABLYCDFGHJKMPRVWXZ 

(3) The fact that the pair of lines with which the process was commenced yield the original 
primary sequence is purely accidental; it might have just as well yielded an equivalent primary 
sequence. 
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j. (1) Having the primary component, the solution of the messages is now a relatively simple 
matter. An application of the method elucidated in paragraph 37 is made, involving the comple- 
tion of the plain-component sequence for each alphabet and selecting those generatrices which 
contain the best assortments of high-frequency letters. Thus, using Message 1: 



Fran Alphabet 


Second Alphabet 


Third Alphabet 


Fourth Alphabet 


Y X K L B 


H U A L U 


Y B 


P T V 


E U V A V 


C 


Z 


M Y 


L 


J 


E 


B 


Y 


E 


C 


L 


R 


I ff 


S 


E ff B 


ff 


D 


Q 


P C 


Y 


K 


S 


L 


C 


S 


D 


Y 


V 


0 X 


T 


S X L 


X 


F 


u 


R D 


C 


M 


T 


Y 


D 


T 


F 


C 


ff 


N Z 


I 


T Z Y 


z 


G 


E 


V F 


D 


P 


I 


C 


F 


I 


G 


D 


X 


A Q 


0 


I QC 


Q 


H 


S 


W G 


F 


R 


0 


D 


G 


0 


H 


F 


z 


B U 


N 


0 U D 


u 


J 


T 


X H 


G 


V 


N 


F 


H 


N 


J 


G 


Q 


L E 


*A 


N E F 


E 


K 


I 


Z J 


H 


W 


A 


G 


J 


A 


K 


H 


u 


Y S 


B 


A S G 


S 


M 


0 


Q K 


J 


X 


B 


H 


K 


B 


M 


J 


E 


C T 


L 


B T H 


T 


P 


N 


U M 


K 


z 


L 


J 


M 


L 


P 


K 


S 


D I 


Y 


L I J 


I 


R 


A 


E P 


M 


Q 


Y 


X 


P 


Y 


R 


M 


T 


F 0 


C 


Y 0 K 


0 


V 


B 


S R 


P 


u 


C 


M 


R 


C 


V 


P 


I 


G N 


D 


C N M 


N 


V 


L 


T V 


R 


E 


D 


P 


V 


D 


W 


R 


0 


H A 


F 


DAP 


A 


X 


Y 


I ff 


V 


s 


F 


R 


W 


F 


X 


V 


N 


J B 


G 


F B R 


B 


z 


C 


0 X 


W 


T 


G 


V 


X 


G 


z 


ff 


A 


K L 


H 


G L,V 


L 


Q 


D 


N Z 


X 


I 


H 


W 


z 


H 


Q 


X 


B 


M Y 


J 


H Y W 


Y 


u 


F 


A Q 


z 


0 


J 


X 


Q 


J 


u 


z 


L 


P C 


K 


J C X 


C 


E 


G 


B U 


Q 


N 


K 


z 


u 


K 


E 


Q 


Y 


R D 


M 


K D Z 


D 


s 


H 


L E 


u 


A 


M 


Q 


E 


U 


S 


u 


C 


V F 


P 


M F Q 


F 


T 


J 


Y S 


E 


B 


P 


u 


S 


P 


T 


E 


D 


ff G 


R 


P G U 


G 


I 


K 


C T 


S 


*L 


R 


E 


T 


R 


I 


S 


F 


X H 


V 


R H E 


H 


0 


M 


D I 


T 


Y 


V 


S 


I 


V 


0 


T 


G 


Z J 


ff 


V J S 


J 


N 


P 


F 0 


I 


C 


W 


T 


0 


W 


N 


I 


H 


Q K 


X 


W K T 


K 


*A 


R 


G N 


0 


D 


X 


I 


N 


X 


A 


0 


J 


U M 


z 


X H I 


M 


B 


V 


H A 


N 


F 


z 


0 


A 


z 


B 


N 


K 


E P 


Q 


Z P 0 


P 


L 


W 


J B 


A 


G 


Q 


N 


B 


Q *L 

FIGURE 48. 


A 


M 


S R 


u 


Q R N 


R 


(2) The selected generatrices (those marked by asterisks in 
columnar manner: 

ALLA 
R R A N 
G E M E 
NTSF 
0 R R E 

Fig tras W. 


Fig 48) are assembled in 
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(3) The key letters are sought and give the keyword SOUP. The plain text for the second 
message is now known, and by reference to the cipher text and the primary components, the 
keyword for this message is found to be TIME. The complete texts are as follows: 



SOUP 

ALLA 

Y H Y E 
R R A N 
X U B U 
G E M E 
K A P V 
N T S F 
L L T A 
0 R R E 
B U V V 
LIEF 
D Y S A 
0 F Y 0 
BPCQ 
U R 0 R 
TUNG 
G A N I 
K F A Z 
Z A T I 
E F I Z 

0 N H A 
B D J E 

V E B E 
Z A L V 
E N S U 

1 D T R 
S P E N 
OQSU 
D E D X 
H A F K 



TIME 
ALLA 
C G S L 
R R A N 
Z Q U B 
G E M E 
M N C T 
N T S F 

Y B V H 
0 R R E 
LQFT 
LIEF 
F L R H 
0 F Y 0 
L M T A 
U R 0 R 

iqzv 

G A N I 
M D Q N 
Z A T I 
S D V N 
0 N H A 
L C B L 

V E B E 
Q N E T 
E N S U 
0 C V S 
S P E N 
N Z R B 
D E D X 
J N 0 Q 



Tioubi SO. 



45. The case of identical messages enciphered by keywords of different lengths. — a. In the 
foregoing case the keywords for the two messages, although different, were identical in length. 
When this is not true and the keywords are of different lengths, the procedure need be only 
slightly modified. 
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6. Given the following two cryptograms suspected of containing the same plain-text en- 
ciphered by the same primary components but with different keywords of different lengths, solve 
the messages. 



























Message No. 1 




















V 


M 


Y 


Z 


G 


E 


A 


U 


N 


T 


P 


K 


FAY 


J I Z 


M 


B 


U M Y 


K 


B 


V 


F 


I 


V V 


s 


E 


0 


A 


F 


S 


K 


X 


K 


R 


Y 


ff 


C A C 


Z 0 R 


D 


0 


Z R D 


E 


F 


B 


L 


K 


F E 


s 


M 


K 


S 


F 


A 


F 


E 


K 


V 


Q 


u 


RCU 


Y Z V 


0 


X 


V A B 


T 


A 


Y 


Y 


U 


0 A 


Y 


T 


D 


K 


F 


E 


N 


W 


N 


T 


D 


B 


QKU 


L A J 


L 


Z 


I 0 U 


M 


A 


B 


0 


A 


F S 


K 


X 


Q 


P 


U 


Y 


M 


J 


P 


V 


Q 


T 


D B T 


0 S I 


Y 


s 


M I Y 


K 


U 


R 


0 


G 


M ff 


C 


T 


M 


Z 


Z 


V 


M 


V 


A 


J 




















































Message No. 2 




















Z 


G 


A 


N 


w 


I 


0 


M 


0 


A 


C 


0 


D H A 


C L R 


L 


p 


M 0 Q 


0 


J 


E 


M 


0 


Q U 


D 


H 


X 


B 


Y 


U 


Q 


M 


G 


A 


u 


V 


G L Q 


DBS 


P 


u 


0 A B 


I 


R 


P 


W 


X 


Y M 


0 


G 


G 


F 


T 


M 


R 


H 


V 


F 


G 


ff 


KNI 


V A U 


P 


F 


A B R 


V 


I 


L 


A 


Q 


E M 


Z 


D 


J 


X 


Y 


M 


E 


D 


D 


Y 


B 


0 


S V M 


P N L 


G 


X 


X D Y 


D 


0 


P 


X 


B 


Y U 


Q 


M 


N 


K 


Y 


F 


L 


U 


Y 


Y 


G 


V 


PVR 


D N C 


Z 


E 


K J Q 


0 


R 


W 


J 


X 


R V 


G 


D 


K 


D 


S 


X 


C 


E 


E 


C 





























c. The messages are long enough to show a few short repetitions which permit factoring. 
The latter discloses that Message 1 has a period of 4 and Message 2, a period of 6 letters. The 
messages are superimposed, with numbers marking the position of each letter in the corresponding 
period, as shown below: 







l 


a 


3 


4 


1 


a 


3 


4 


1 


a 


3 


4 


1 


a 


3 


4 


1 


2 


3 


4 


l 


2 


3 


4 


No. 


1. 


V 


M 


Y 


z 


G 


E 


A 


u 


N 


T 


P 


K 


F 


A 


Y 


J 


I 


Z 


M 


B 


U 


M 


Y 


K 


No 


2. 


Z 


G 


A 


N 


ff 


I 


0 


M 


0 


A 


c 


0 


D 


H 


A 


C 


L 


R 


L 


P 


M 


0 


Q 


0 






1 


a 


8 


4 


s 


« 


l 


a 


3 


4 


8 


8 


i 


a 


8 


4 


6 


s 


i 


a 


3 


4 


8 


8 






1 


a 


3 


4 


l 


a 


3 


4 


1 


a 


3 


4 


i 


a 


3 


4 


1 


a 


3 


4 


1 


2 


3 


4 


No. 


1. 


B 


V 


F 


I 


V 


V 


s 


E 


0 


A 


F 


s 


K 


X 


K 


R 


Y 


ff 


C 


A 


c 


z 


0 


R 


No. 


2. 


J 


E 


M 


0 


Q 


U 


D 


H 


X 


B 


Y 


u 


Q 


M 


G 


A 


U 


V 


G 


L 


Q 


D 


B 


S 






l 


a 


3 


4 


6 


« 


i 


a 


3 


4 


8 


8 


i 


a 


3 


4 


6 


6 


i 


2 


3 


4 


8 


8 






l 


a 


3 


4 


1 


a 


3 


4 


1 


3 


a 


4 


i 


a 


3 


4 


1 


3 


3 


4 


1 


2 


3 


4 


No. 


1. 


D 


0 


z 


R 


D 


E 


F 


B 


L 


K 


F 


E 


S 


H 


K 


s 


F 


A 


F 


E 


K 


V 


Q 


u 


No. 


2. 


P 


U 


0 


A 


B 


I 


R 


P 


ff 


X 


Y 


M 


0 


G 


G 


F 


T 


M 


R 


H 


V 


F 


G 


w 






i 


a 


3 


4 


3 


6 


i 


a 


3 


4 


8 


8 


1 


a 


8 


4 


8 


8 


i 


2 


3 


4 


8 


6 






i 


a 


3 


4 


1 


1 


3 


4 


1 


a 


3 


4 


1 


a 


3 


4 


1 


2 


3 


4 


1 


2 


3 


4 


No. 


1. 


R 


C 


M 


Y 


Z 


V 


0 


X 


V 


A 


B 


T 


A 


Y 


Y 


u 


0 


A 


Y 


T 


D 


K 


F 


E 


No. 


2. 


K 


N 


I 


V 


A 


u 


P 


F 


A 


B 


R 


V 


I 


L 


A 


Q 


E 


M 


Z 


D 


J 


X 


Y 


M 






i 


a 


3 


4 


8 


8 


1 


a 


8 


4 


8 


8 


i 


2 


3 


4 


8 


8 


i 


a 


3 


4 


6 


8 






i 


a 


3 


4 


1 


2 


3 


4 


1 


2 


3 


4 


i 


2 


3 


4 


1 


a 


3 


4 


1 


a 


3 


4 


No. 


1. 


N 


ff 


N 


T 


D 


B 


Q 


K 


u 


L 


A 


J 


L 


z 


I 


0 


u 


M 


A 


B 


0 


A 


F 


s 


No. 


2. 


E 


D 


D 


Y 


B 


0 


S 


V 


M 


P 


N 


L 


G 


X 


X 


D 


Y 


D 


0 


P 


X 


B 


Y 


u 






i 


a 


3 


4 


6 


« 


i 


a 


8 


4 


8 


8 


i 


2 


3 


4 


8 


6 


i 


a 


3 


4 


8 


6 






l 


a 


3 


4 


1 


2 


3 


4 


1 


a 


3 


4 


i 


3 


3 


4 


1 


3 


8 


4 


1 


a 


3 


4 


No. 


1. 


K 


X 


Q 


P 


U 


Y 


M 


J 


P 


ff 


Q 


T 


D 


B 


T 


0 


S 


I 


Y 


s 


M 


I 


Y 


K 


No. 


2. 


Q 


M 


N 


K 


Y 


F 


L 


u 


Y 


Y 


G 


V 


P 


V 


R 


D 


N 


c 


Z 


E 


K 


J 


Q 


0 






i 


a 


3 


4 


6 


« 


i 


2 


8 


4 


8 


8 


i 


a 


3 


4 


8 


8 


l 


a 


3 


4 


8 


8 






i 


a 


3 


4 


1 


2 


3 


4 


1 


2 


8 


4 


l 


2 


3 


4 


















No. 


1. 


U 


R 


0 


G 


M 


V 


c 


T 


M 


z 


z 


V 


M 


V 


A 


J 


















No. 


2. 


R 


ff 


J 


X 


R 


V 


G 


D 


K 


D 


s 


X 


C 


E 


E 


c 






















i 


2 


3 


4 


8 


e 


i 


2 


3 


4 


8 


6 


i 


a 


3 


4 
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d. A reconstruction skeleton of "secondary alphabets" is now made by distributing the 
letters in respective lines corresponding to the 12 different superimposed pairs of numbers. For 
example, all pairs corresponding to the superimposition of position 1 of Message 1 with position 1 
of Message 2 are distributed in lines 0 and 1 of the skeleton. Thus, the very first superimposed 



pair is 



z , the letter Z is inserted in line 1 under the letter V. The next { J pair is the 13th super- 

. i 

imposition, with j p, the letter D is inserted in hne 1 under the letter F, and so on. The skeleton 
is then as follows. 



0 


A 


B 


C 


D 


E 


F 


G 


H 


I 


T 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


w 


X 


Y 


Z 


1-1 


I 


J 




P 




D 










Q 


G 


C 


E 








K 


0 




R 


z 










2-2 


H 


V 


N 




















G 




u 






W 








E 


D 


M 


L 


X 


3-3 


E 










M 






X 




G 




I 


D 


J 




N 






R 










A 


0 


4-4 














X 




0 


c 










D 


K 




A 


F 


Y 


Q 








V 


N 


1-5 








B 




T 


w 




L 








R 




E 








N 




Y 


Q 






U 


A 


2-6 


M 


0 






I 








C 








D 


















U 


V 




F 


R 


3-1 


0 




G 






R 














L 




P 




S 




D 












Z 




4-2 


L 


P 






H 










u 


V 
















E 


D 


M 






F 






1-3 






Q 


J 














V 


W 


K 


0 


X 


Y 










M 


A 










2-4 


B 
















J 




X 


P 


0 














A 




F 


Y 






D 


3-5 


N 


R 








Y 


















B 


C 


G 
















Q 


S 


4-6 










_M_ 










L 


_0 














S 


U_ 


V 


W 


X 











Fiouu (1 



e. There are more than sufficient data here to permit of the reconstruction of a complete 
equivalent primary component, for example, the following: 

1 3 3 4 fi 8 7 8 9 10 11 13 13 14 18 18 17 18 19 20 21 22 23 34 25 36 

ITKNPZHMWBQEULFCSJAXRGDVOY 

j. The subsequent steps in the actual decipherment of the text of either of the two messages 
are of considerable interest. Thus far the cryptanalyst has only the cipher component of the 
primary sliding components. The plain component may be identical with the cipher com- 
ponent and may progress in the same direction, or m the reverse direction; or, the two com- 
ponents may be different. If different, the plain component may be the normal sequence, 
direct or reversed. Tests must be made to ascertain which of these various possibilities is true. 

g. (1) It will first be assumed that the primary plain component is the normal direct 
sequence. Applying the procedure outlined in Par. 23 to the message with the shorter key 
(Message No. 1, to give the most data per secondary alphabet), an attempt is made to solve 
the message. It is unnecessary here to go further into detail in this procedure; suffice it to 
indicate that the attempt is unsuccessful and it follows that the plain component is not the 
normal direct sequence. A normal reversed sequence is then assumed for the plain component 
and the proper procedure applied. Again the attempt is found useless. Next, it is assumed 
that the plain component is identical with the cipher component, and the procedure outlined in 
Par. 37 is tried. This also is unsuccessful. Another attempt, assuming the plain component 
runs m the reverse direction, is likewise unsuccessful. There remains one last hypothesis, viz, 
that the two primary components are different mixed sequences. 
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(2) Here is Message No. 1 transcribed in periods of four letters. Uniliteral frequency 
distributions for the four secondary alphabets are shown below in Fig. 52, labeled la, 2a, 3a, 
and 4a These distributions are based upon the normal sequence A to Z. But since the recon- 
structed cipher component is at hand these distributions can be rearranged according to the 
sequence of the cipher component, as shown in distributions labeled 15, 26, 35, and 45 in Fig 52. 
The latter distributions may be combined by shifting distributions 2b, Sb, and Jfi to proper super- 
impositions with respect to lb so as to yield a single monoalphabetic distribution for the entire message. 
In other words, the polyalphabetic message can be converted into monoalphabetic terms, thus very 
considerably simplifying the solution. 

Message No 1 

VMYZ V A B T la. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

GEAU AYYU 

NTPK 0 A Y T | as ^ =s a* ^ ^ ^ 

2a. ABCDEFGHI JKLUNOPQRSTUVWXYZ 

FAYJ DKFE 

IZMBNWNT ^ ^ =a 

DU YK DBQK 3a - ABCDEFGHIJKLMNOPQRSTUVWXYZ 

BVFI ULAJ 

VVSE LZIO 4a ABCDEFGHIJKLMNOPQRSTUVWXYZ 

OAFS UUAB 

KXKR OAFS 

YWCA K X Q ft 

j 

CZORUYMJ ^ ^ 

DOZR PWQT 5 lb - ITKNPZHMWBQEULFCSJXXRGDVOY 

DEFBDBTO 

LKFE S I Y S 25. ITKNPZHMwIqIuLFCSJAXRGDVOY 

SMKS MIYK 

FAFEUROG ^ 5 | 5 % | 

36. ITKNPZHMWBQEULFCSJAXRGDVOY 

KVQUMWCT 
RCMY MZZV 

ZVOX M V A J 46. iTKNPZHMWBQEULFCSJAXRGDVOY 

Fiauwsa. 



k 
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(3) Note in Fig. 53 how the four distributions are shifted for superimposition and how the 
combined distribution presents the characteristics of a typical monoalphabetic distribution. 

15. ITkIpZHMSBQEULFCS J AXRGD V 0 Y 

g g 5 

25. EULFCSJAXRGDVOYITKNPZHMWBQ 

35. KNPZHMWBQEULFCSJAXRGDVOYIT 

= 5% 53 as g3 

45 pzhmwbqeOlfcsjaxrgdvoyitkn 



as?§ g 5 V g as§ii!§ 

15.-45. 3* ^ 3 3 3 3 3-^ 3 3 3 3 

combined ITKNPZHM1BQEULFCSJAXRGDV0Y 

Figure S3 



(4) The letters belonging to alphabets 2, 3, and 4 of Fig. 52 may now be transcribed in terms 
of alphabet 1 That is, the two E’s of alphabet 2 become I’s, the L of alphabet 2 becomes a K; 
the C becomes a P, and so on Likewise, the two K’s of alphabet 3 become I’s, the N becomes 
a T, and so on The entire message is then a monoalphabet and can readily be solved. It is as 



follows. 
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F 


M 


U 


M 


K 


U 


W 


ff 


R 


P 


Z 


G 


Z 


U 


D 


C 


V 


M 


M 


V 


A 
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V 


W 


0 


M 


A 


N H 


0 


U 


R 


0 


R 


P 
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S 


I 


B 


L 


Y 
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N 


G 


E 


R 


R 


E 


Q 
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R 


V 


V D 
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U 
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M 


U 


U 


E 


I N 
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T 
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ff 
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D 
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S S 
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0 


U 


L 


D 


B 


E 


S 


E 


N 


T 


V 


I 


A 


G 


E 


0 


R 


G 


E 


T 


0 


W 


N 


F 


R 


E 


L 


V H 


R 


N 


X 


M 


U 


S 


L 
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C 
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R 


0 


A 


D 











































(5) Having the plain text, the derivation of the plain component (an equivalent) is an easy 
matter It is merely necessary to base the reconstruction upon any of the secondary alpha- 
bets, since the plain text — cipher relationship is now known directly, and the primary cipher 
component is at hand The primary plain component is found to be as follows: 

1 a S 4 S • 7 8 8 10 11 12 13 14 18 16 17 18 19 20 21 22 23 24 2ft 28 

HMPCBL.RSW. . ODUGAFQKIYNETV 

(6) The keywords for both messages can now be found, if desirable, by finding the equivalent 
of A p in each of the secondary alphabets of the original polyalphabetic messages. The keyword 
for No. 1 is STAR; that for No 2 is OCEANS. 



817914 0 - 43 -7 
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(7) The student may, if he wishes, try to find out whether the primary components recon- 
structed above are the original components or are equivalent components, by examining all the 
possible decimations of the two components for evidences of derivation from keywords. 

h As already stated in Par 26m, there are certain statistical and mathematical tests that 
can be employed m the process of “matching” distributions to ascertain proper supenmpositions 
for monoalphabeticity. In the case just considered there were sufficient data m the distributions 
to permit the process to be applied successfully by eye, without necessitating statistical tests. 

i. This case is an excellent illustration of the application of the process of converting a 
polyalphabetic cipher into monoalphabetic terms Because it is a very valuable and important 
cryptanalytic "trick,” the student should study it most carefully in order to gain a good under- 
standing of the principle upon which it is based and its significance m cryptanalysis The 
conversion in the case under discussion was possible because the sequence of letters forming the 
cipher component had been reconstructed and was known, and therefore the umhteral dis- 
tributions for the respective secondary cipher alphabets could theoretically be shifted to correct 
supenmpositions for monoalphabeticity. It also happened that there were sufficient data in 
the distributions to give proper indications for their relative displacements. Therefore, the 
theoretical possibility in this case became an actuality. Without these two necessary conditions 
the superimposition and conversion cannot be accomplished. The student should always be 
on the lookout for situations in which this is possible. 

46. Concluding remarks . — a The observant student will have noted that a large part of 
this text is devoted to the elucidation and application of a very few basic principles. These 
principles are, however, extremely important and their proper usage in the hands of a skilled 
cryptanalyst makes them practically indispensable tools of his art. The student should therefore 
drill himself m the application of these tools by having someone make up problem after problem 
for him to practice upon, until he acquires facility in their use and feels competent to apply 
them in practice whenever the least opportunity presents itself This will save him much time 
and effort in the solution of bona fide messages 

b Continuing the analytical key introduced in Military Cryptanalysis Fart I, the outline 
for the studies covered by Part II follows herewith 
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Analytical Key for Military Cryptanalysis, Part II * 

(Numbers in parentheses refer to Puragrnph Numbers in this text) 




•For explanation of the use of this iliart see Par 'ill of Military Cryptanalysis, Part I 
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APPENDIX 1 

The 12 Types or Cipher Squares 
(See Paragraph 7) 

Table I-B. 1 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWN0X 
Enciphering equations* 0*/a=0i/i; 0 p /i=0 o /a (0i/i is A). 



PLAIN TEXT 





A 
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J 
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P 
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S 
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ff 
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N 
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E 
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Q 
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A 
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ff 


N 


0 
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D 
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M 
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V 


i 
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X 
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D 


J 


u 




K 
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ff 
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E 
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ff 
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ff 
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P 
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K 
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ff 
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G 
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A 
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N 
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F 
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N 


0 
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ff 
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« N 




0 


X 
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G 


S 
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I 
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D 
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□ 


R 


c 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 


J 


V 


Q 


A 


L 


W 


jj 


0 


n 


F 


B 


P 


Q 


R 


c 


Q 


Z 


I 


G 


S 


E 


H 


T 


D 
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F 


B 


P 
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_D 
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A 
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_ff 


_N 


_0_ 
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P 
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_R 
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Q 



1 Thu table is labeled “Table 1-B” because it is the same as Table 1-A on page 7, except that the horizontal 
lines of the latter have been shifted so as to begin the successive alphabets with the successive letters of the normal 
sequence. 

( 06 ) 
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Table II 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWNOX 

Enciphering equations: 9k/a=0i/i; 9p/a=0 e /i (0t/i is A). 



PLAIN TEXT 
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Table III 

Components - 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) F B P Y R C Q Z I G S E H T D J U M K V A L O 0 X 
Enciphering equations G k/ i=9i/3, 9 p /i = 0 e /2 (B ( / 2 is F). 



PLAIN TEXT 

BCDEFGHIJKLMNOPQRS 
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Table IV 

Components’ 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWN0X 
Enciphering equations: 0*/i=0i/>; 9 D /a=9o/i (0i/» is F). 



PLAIN TEXT 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 
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Table V 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVffXYZ 

(2) F B P Y R C Q Z I G S E H T D J U V K V A L O 0 X 
Enciphering equations 0*/3=0 p /i; 0i/i=0«/2 C©i/i is A). 



PLAIN TEXT 
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Table VI 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWN0X 
Enciphering equations* 0k/j=9 e /i; 9in=0p/» (0i/i is A). 
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Table VII 

Components: 

(1) — ABCDEFGHIJKLMNOPQRSTUVffXYZ 

(2) — FBPYRCQZIGSEHTDJUMKVALWNOX 
Enciphering equations. 0»/j=9 p /i; 0 l/t =9 e /i (0|/a is F). 



PLAIN TEXT 





A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


u 


V 


ff 


X 


Y 


Z 


A 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


□ 


V 


W 


X 


Y 


Z 


A 


B 


c 


D 


E 


F 


B 


Z 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


ff 


X 


Y 


C 


V 


W 


X 


Y 


Z 


A 


B 


□ 


D 


E 


F 


G 


□ 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


D 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


□ 


z 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


E 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


z 


A 


B 


c 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


F 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


G 


R 


S 


T 


U 


V 


ff 


X 


Y 


Z 


A 


B 


C 


D 


E 


F 


0 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


H 


0 


P 


Q 


R 


S 


T 


u 


V 


w 


□ 


Y 


m 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


I 


S 


T 


u 


V 


W 


X 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


J 


L 


M 


N 


0 


F 


Q 


R 


S 


T 


□ 


V 


V 


X 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


K 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


u 


V 


□ 


X 


D 


z 


A 


B 


C 


D 


E 


F 


G 


H 


x L 

N 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


0 


□ 


Q 


V 


X 


Y 


Z 


A 


B 


c 


D 


E 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


□ 


0 


A 


B 


C 


P 


E 


F 


G 


□ 


I 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


0 


R 


s 


T 


U 


V 


W 


X 


Y 


Z 


A 


B 


C 


0 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


i| 


0 


R 


S 


T 


U 


V 


w 


X 


Y 


Z 


A 


B 


P 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


H 


I 


0 


K 


L 


M 


N 


0 


P 


Q 


R 


s 


T 


U 


V 


ff 


X 


Q 


U 


V 


W 


X 


Y 


Z 


A 


B 


C 


D 


E 


n 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


R 


□ 




Y 


Z 


A 


B 


C 


D 


E 


F 


G 




I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 




T 


U 


V 


S 


Q 




S 


T 


U 


V 


W 


X 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


fj 


N 


0 


P 


T 


N 


0 


P 


Q 


R 


S 


□ 


U 


V 


ff 


X 


Y 


M 


A 


B 


C 


D 


m 


F 


G 


H 


I 


0 


K 


L 


M 


U 


K 


L 


M 


N 


0 


P 


0 


R 


m 


T 


u 


V 


n 


X 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


V 


H 


I 


J 


K 


L 


M 


N 


0 


p 


Q 


R 


S 


El 


u 


V 


□ 


X 


Y 


Z 




B 


C 


D 


E 


F 


0 


w 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


u 


V 


W 


y 


Y 


Z 


A 


B 


C 


D 


X 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


0 


0 


P 


Q 


R 


S 


T 


n 


V 


w 


X 


Y 


Z 


A 


Y 


□ 


Y 


Z 


A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


□ 


N 


0 


P 


Q 


R 


s 


T 


U 


V 


ff 


Z 


m 


U 


V 


W 


□ 


Y 


Z 


A 


B 


□ 


D 


E 


m 


G 


H 


I 


J 


K 


L 


□ 


N 


0 


P 


0 


R 


S 









































































REF ID:A6456Q 



Table VIII 

Components. 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWN0X 

Enciphering equations. 0k/a=9 e /i, 9i/i=9 P /i (0 t /j is F). 
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PLAIN TEXT 
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Table IX* 

Components: 

(1) ABCDEFGHZJXLMNOPQRSTUVWXYZ 

(2) F B P V R C Q Z I G S E H T D J U H K V A L W H 0 X 
Enciphenng equations. 0k/i=0p/aJ ©i/i=0o/i (0i/i is A). 
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1 An interesting fact about this case is that if the plain component is made identical with the cipher com- 
ponent (both being the sequence FBPY . . .), and if the enciphering equations are the same as for Table 1-B. 
then the resultant cipher square is identical with Table IX, except that the key letters at the left arein the 
order of the reversed mixed component, FXON .... In other words, the secondary cipher alphabets produced 
by the interaction of two identical mixed components are the same as those given by the interaction of a 
mixed component and the normal component. 
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Table X s 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) FBPYRCQZIGSEHTDJUMKVALWN0X 

Enciphering equations: 0»/i=0*/a; 6in=0 P /s (0i/i is A). 
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* Footnote 2 to Table IX, page 104, also applies to this table, except that the key letters at the left will 
follow the order of the direct mixed component 
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Table XI 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) F B P Y R C Q Z I G S E H T D J D M K V A L R H 0 X 

Enciphering equations: 0*/i=0 p /s; 0i/s=9«/i (©i/a is F). 



PLAIN TEXT 





A 


B 


C 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 
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Table XTI 

Components: 

(1) ABCDEFGHIJKLMNOPQRSTUVWXYZ 

(2) F B P Y R C Q Z I G S E H T D J U U K V A L W N 0 X 

Enciphering equations: 6k/i=6 e/ i; 6 i/i=:6 d /i (0|/ s is F). 



PLAIN TEXT 





A 
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p 
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Q 


c 


R 
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T 
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V 
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0 
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S 


G 
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El 
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A 
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F 


X 


0 


N 




L 




V 


K 


M 


U 


J 


D 


T 


H 


0 


S 


0 


J 


0 


i 


z 


Q 


13 


R 
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APPENDIX 2* 

Elementary Statistical Theory Applicable to the Phenomena of Repetition 

in Cryptanalysis 

1. Introductory. — a In Par 9c it was stated that the phenomena of repetition in crypt- 
analytics may be removed from the realm of intuition and dealt with statistically. The dis- 
cussion of the matter will here be confined to relatively simple phases of the theory of probability, 
a definition of which implies philosophical questions of no practical interest to the student of 
cryptanalysis For his purposes, the following definition of a prion probability will be sufficient- 

The probability that an event will occur is the ratio of the number of “fav- 
orable cases” to the number of total possible cases, all cases being equally 
likely to occur By a "favorable case” is meant one which will produce the 
event in question. 

b. In what follows, reference will be made to random assortments of letters and especially to 
random text By the latter will be meant merely that the text under consideration has been as- 
sumed to have been enciphered by somo more or less complex cryptographic system so that for 
ail practical purposes the sequence of letters constituting this text is a random assortment, that 
is, the sequence is just about what would have been obtained if the letters had been drawn at 
random out of a box containing a large number of the 26 letters of the alphabet, all in equal 
propoitions, so that iheie are exactly the same numbers of A’s, B’s, C’s, Z’s It is assumed 
that each time in making a drawing from such a box, the latter is thoroughly shaken so that the 
letters arc thoroughly mixed and then a single letter is selected at random, recorded, and 
replaced m the same box In what follows, the word “box” will refer to the box as described 

c A umliteral frequency distribution of a large volume of random text will be “fiat,” 
i e , lacking crests and troughs 

d For purposes of statistical analysis, the text of a monoalphabetic substitution cipher is 
equivalent to plain text As a corollary, when a polyalphabctic substitution cipher has been 
reduced to the simple terms of a set of monoalphabets, l e , when the letters constituting the 
cipher text have been allocated into their proper umliteral distributions, the letters falling into 
the respective distributions are statistically equivalent to plain text 

2. Data pertaining to single letters. — a (1) A single letter will be drawn at random from 
the box. What is the probability that it will be an A ? According to the foregoing definition of 
probability, since the total number of possible cases is 26 and the rnunbor of favorable cases is 

here only 1, the probability is 1 26=-^= 0385 This is the piobability of drawing an A from 

the box The probability that the letter drawn will be a B, a C, a D, , a Z is the same as for A. 
In other words, the probability of drawing any specified single letter is p= 0385. 

(2) The value p— 0385, as found above, may also be termed the probability constant for 
single letters in random text of a 26-letter alphabet For any language this constant is merely 
the reciprocal of the total number of different characters which may be employod in writing the 
text in question 

1 In the preparation of this appendix, the author has had the benefit of the \ery helpful suggestions of 
Capt H. G Miller, Signal Corps, Mr F B Rowlett, Dr S Kullback, and Dr A Sinkov, Assistant Cryptanalysts, 
O C Sig O Certain parts of Dr Kullback’s important paper "Statistical Methods in Cryptanalysis" form 
the basis of the discussion 
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(3) Another way of interpreting the notation p=.0385 is to Bay that in a large volume of 
random text, for example in 100,000 letters, any letter that one may choose to specify may be 
expected to occur about 3,850 times; in 10,000 letters it may be expected to occur about 385 
times; in 1,000 letters, about 38 5 times, and so on. In every-day language it would be said 
that “in the long run” or “on the average” in 1,000 letters of random text there will be about 
38 5 occurrences of each of the 26 letters of the alphabet. 

(4) But unfortunately, in cryptanalysis it is not often the case that one has such a large 
number of letters available for study in any single cipher alphabet. More often the cryptanalyst 
has a relatively small number of letters and these must be distributed over several cipher 
alphabets. Hence it is necessary to be able to deal with smaller numbers of letters. Consider 
a specific piece of random text of only 100 letters. It has been seen that “in the long run” 
each letter may be expected to occur about 3.85 timeB in this amount of random text; that is, 
the 26 letters will have an average frequency of 3.85. But in reaching this average of 3 85 
occurrences in 100 letters, it is obvious that some letter or letters may not appear at all, some 
may appear once, some twice, and so on. How many will not appear at all, how many will 
appear 1, 2, 3, . . . times? In other words, how will the different categories of letters (differ- 
ent in respect to frequency of occurrence) be distributed, or what will the distribution be like? 
Will it follow any kind of law or pattern? The cryptanalyst also wants to know the answer 
to questions such as these: What is the probability that a specified letter will not appear at 
all in a given piece of text? That it will appear exactly 1 , 2, 3, . . . times? That it will appear 
at least 1 , 2, 3, . . . times? The same Bort of questions may be asked with respect to digraphs, 
trigraphs, and so on. 

b. (1) It may be stated at once that questions of this nature are not easily answered, and 
a complete discussion falls quite outside the scope of this text. However, it will be sufficient 
for the present purposes if the student is provided with a more or less simple and practical means 
of finding the answers. With this in view certain curves have been prepared from data based 
upon Poisson’s exponential expansion, or the "law of small probabilities” and their use will 
now be explained Students without a knowledge of the mathematical theory of probability 
and statistics will have to take the curves “on faith” Those interested in their derivation are 
referred to the following texts: 

Fisher, R. A , Statistical Methods for Research Workers, London, 1937. 

Fry, T. C , Probability and Its Engineering Uses , New York, 1928. 

(2) By means of these probability curves, it is possible to find, in a relatively easy manner, 
the probability for 0, 1, 2, . . . 11 occurrences of an event m n cases, if the mean (expected, 
average, probable) number of occurrences in these n cases is known. For example, given a cryp- 
togram equivalent to 100 letters of random text, what is the probability that any specified smgle 
letter, whatever will not appear at all m the cryptogram? Since the probability of the occurrence 

of a specified single letter is 0385, and there are 100 letters in the cryptogram, the average 

or expected or mean number of occurrences of an A, a B, a C, . . ., is 0385X100=3 85. Refer 
now to that probability curve which is marked “/ 0 ”, meaning “frequency zero”, or “zero occur- 
rences ” On the horizontal or x axis of that curve find the point corresponding to the value 
3.85 and follow the vertical coordinate determined by this value up to the point of intersection 
with the curve itself, then follow the horizontal coordinate determined by this intersection point 
over to the left and read the value on the vertical axis of the curve. It is approximately .021. 
This means that the probability that a specified single letter (an A, a B, a C, . . .) will not appear 
at all in the cryptogram, if it really were a perfectly random assortment of 100 letters, is .021. 
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That is, according to the theory of probability, in 1,000 cases of random-text messages of 100 
letters each, one may expect to find about 21 messages in which a specified single letter will not 
appear at all. Another way of saying the same thing is: If 1,000 sets of 100 letters of random 
text are examined, in about 21 out of the 1,000 such sets any letter that one may choose to 
name will be absent. This, of course, is merely a theoretical expectancy, it indicates only 
what probably will happen in the long run. 

(3) What is the probability that a specified single letter will appear exactly once in 100 
letters of random text? To answer this question, find on the curve marked the point of 
intersection of the vertical coordinate corresponding to the mean or average value 3 85 with 
the curve; follow the horizontal coordinate thus determined over to the vertical scale at the 
left; read the value on this scale. It is 082, which means that in 1,000 cases of random-text 
messages of 100 letters each, one may expect to find about 82 messages in which any letter 
one chooses to specify will occur exactly once, no more and no less. 

(4) In the same way, the probability that a specified single letter will appear exactly twice 
is found to be .158; exactly 3 times, 202, and so on, as shown in the table below* 



100 letters of random text 



Fretjaency 


Probability that 
a specified tingle 
letter will occur 
exactly s times 


0 


a 021 


i 


.082 


2 


. 158 


3 


.202 


4 


.195 


5 


.150 


6 


.096 


7 


.053 


8 


.026 


9 


.011 


10 


.004 


11 


.001 



(5) To find the probability that a specified single letter will occur at least 1, 2, 3, . . . times 
in a series of letters constituting random text, one reasons as follows: Since the concept “at least 
1” implies that the number specified is to be considered only as the minimum, with no limit 
indicated as to maximum, occurrences of 2, 3, 4, . . . are also “favorable" cases; the probabilities 
for exactly 1, 2, 3, 4, . . . occurrences should therefore be added and this will give the probability 
for “at least 1." Thus, in the case of 100 letten, the sum of the probabilities for exactly 1 to 11 
occurrences, as set forth in the table directly above, is .078, and the latter value approximates 
the probability for at least 1 occurrence. 

(6) A more accurate result will be obtained by the following reasoning. The probability 
for zero occurrences is .021. Since it is certain that a specified letter will occur either zero times 
or 1, 2, 3, . . . times, to find the probability for at least one time it is merely necessary to sub- 
tract the probability for zero occurrences from unity. That is, 1— .021— .979, which is .001 
greater than the result obtained by the other method. The reason it is greater is that the value 
.979 includes occurrences beyond 11, which were excluded from the previous calculation. Of 
course, the probabilities for these occurrences beyond 1 1 are very small, but taken all together they 
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Curves showing probability for 0, 1, 2, and 3 occurrences of an event in n cases, given the mean number of occurrences 
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Curves showing probability for 4, 5, 6, and 7 occurrences of an event m n cases, given the mean number of occurrences 
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add up to .001, the difference between the results obtained by the two methods The proba- 
bility for at least 2 occurrences is the difference between unity and the sum of the probability 
for zero and exactly 1 occurrences; that is, 1 — (P 0 +Pi)=l — ( 021+.082)=1— 103=.897. The 
respective probabilities for various numbers of occurrences of a specified single letter (from 0 to 
11) are given in the following table: 



100 letters of random text 



Frequency 


Probability that a 
specified single 
letter will occur 
exactly x 
times 


Probability that a 
specified single 
letter mil occur 
at least x 
times 


0 


0.021 


1.000 


1 


.082 


.979 


2 


. 158 


.897 


3 


.202 


.739 


4 


. 195 


.537 


5 


.150 


.342 


6 


096 


. 192 


7 


053 


.096 


8 


.028 


043 


9 


.011 


.017 


10 


.004 


. 006 


11 


.001 


.002 



(7) The foregoing calculations refer to random text composed of 100 letters. For other 
numbers of letters, it is merely necessary to find the mean (multiply the probability for drawing 

a specified single letter out of the box, which is ^ or .0385, by the number of letters in the 

assortment) and refer to the various curves, as before. For example, for a random assortment 
of 200 letters, the mean is 200 X .0385, or 7.7, and this is the value of the point to be sought along 
the horizontal or z axes of the curves; the intersections of the respective vertical lines correspond- 
ing to this mean with the various curves for 0, 1, 2, 3, . . . occurrences give the probabilities for 
these occurrences, the reading being taken on the vertical or y axes of the curves. 

(8) The discussion thus far has dealt with the probabilities for 0, 1, 2, 3, . . . occurrences 
of specified single letters It may be of more practical advantage to the student if he could be 
shown how to find the answer to these questions: Given a random assortment of 100 letters 
ho w many letters may be expected to occur exactly 0, 1, 2, 3, . . . times? How many may be 
expected to occur at least 1, 2, 3, . . . times? The curves may here again be used to answer 
these questions, by a very simple calculation, multiply the probability value as obtained above 
for a specified single letter by the number of different elements being considered. For example, 
the probability that a specified single letter will occur exactly twice in a perfectly random assort- 
ment of 100 letters is .158; since the number of different letters is 26, the absolute number of single 
letters that may be expected to occur exactly 2 times in this assortment is .158X26=4.108. 
That is, in 100 letters of random text there should be about four letters which occur exactly 2 
tunes The following table gives the data for various numbers of occurrences 
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100 lettert of random text 



Frequency 

<*> 


Probability that a 
specified single 
letter trill occur 
exactly z 
times 


Probability that a 
specified single 
letter will occur 
at leasts 
times 


Probable number 
of letters appear- 
ing exactly x 
times 


Probable number 
of letters appear- 
ing at leasts 
times 


| 


■■ 


1.000 


0.546 


26.000 






.979 


2 132 


25.454 






.897 


4 108 


22 322 






.789 


5.252 


19.214 




. 195 


.587 


5. 070 


12 962 


5 


. 150 


.342 


3.900 


8.892 


6 




.192 


2 496 


4 992 


7 


.053 


.096 


1.378 


2 496 


8 


.026 


043 


.676 


1. 118 


9 


.011 


.017 


.286 


.442 


10 


.004 


.006 


. 104 


. 156 


11 


.001 


.002 


026 


.052 



(9) Referring again to the curves, and specifically to the tabulated results set forth directly 
above, it will be seen that the probability that there will be exactly two occurrences of a specified 
single letter in 100 letters of random text (.158), is less than the probability that there will be 
exactly three occurrences (.202); m other words, the chances that a specified single letter will 
occur exactly three times are better, by about 25 percent, than that it will occur only two times. 
Furthermore, there will be about five letters which will occur exactly 3 times, and about five 
which will occur exactly 4 times, whereas there will be only about two letters which will occur 
exactly 1 time. Other facts of a similar import may be deduced from the foregoing table. 

c. The discussion thus far has dealt with random assortments of letters. What about other 
types of texts, for example, normal plain text? What is the probability that E will occur 0, 1, 
2, 3, • . . times in 50 letters of normal English? The relative frequency value or probability 
that a letter selected at random from a large volume of normal English text will be E is .12604. 
(In 100,000 letters E occurred 12,604 times.) For 50 letters this value must be multiplied by 50, 
giving 6.3 as the mean or point to be found along the x axes of the curves. The probabilities for 
0, 1, 2, 3, . . . occurrences are tabulated below: 



60 lettert of normal Engltth plain text 



Frequency 

(*) 


Probability that 
an E will be 
drawn exactly 
x times 


Probability that 
an E will be 
drawn at least 
s times 


■l 


a 002 


1 000 




.011 


.998 




.036 


.987 




.076 


.951 






.875 


5 


. 151 


.755 


6 


. 159 


.604 


7 


. 143 


.445 


8 


. 113 


. 302 


9 


.079 


. 223 


10 


.050 


. 173 


11 


.029 


.123 
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d. (1) It has been seen that the probability of occurrence of a specified single letter in random 

text employing a 26-letter alphabet is P~^q = - 0385. If a considerable volume of such text is 

written on a large sheet of paper and a pencil is directed at random toward this text, the probabil- 
ity that the pencil point will hit the letter A, or any other letter which may be specified m advance, 
is .0385. Now suppose two pencils are directed simultaneously toward the sheet of paper. The 

probability that both pencil points will hit two A’s is ^X^=2^=. 00148, since m this case 

one is dealing with the probability of the simultaneous occurrence of two events which are 

, * l 

independent. The probability of hitting two B'b, two C’b, . . ., two Z’s is likewise ^ Hence, 

if no particular letter is specified, and merely this question is asked. “What is the probability 
that both pencil points will hit the same letter?” the answer must be the sum of the separate 
probabilities for simultaneously hitting two A's, two B’s, and bo on, for the whole alphabet, 

which is 26X2^=^= .0385. This, then, is the probability that any two letters selected at random 

in random text of a 26-letter alphabet will be identical or will coincide. Since this value remains 
the same so long as the number of alphabetic elements remains fixed, it may be said that the 
probability of monographic coincidence in random text of a 26-element alphabet is 0385 The fore- 
going italicized expression 2 is important enough to warrant assigning a special symbol to it, viz. 
Kr (read “kappa sub-r”). For a 26-element alphabet, then, * r = 0385 

(2) Now if one asks. “Given a random assortment of 10 letters, what are the respective 
probabilities of occurrence of 0, 1, 2, . . single-letter coincidences’” one proceeds as follows. 

As before, it is first necessary to find the mean or expected number of coincidences and then 
refer to the various probability curves To find the mean, one reasons as follows Given a 
sequence of 10 letters, one may begin with the 1st letter and compare it with the 2d, 3d, . . . 10th 
letter to see if any two letters coincide; 9 such comparisons may be made, or in other words there 
are, beginning with the 1st letter, 9 opportunities for the occurrence of a coincidence But 
one may also start with the 2nd letter and compare it with the 3d, 4th . . 10th letter, thus 

yielding 8 more opportunities for the occurrence of a coincidence, and so on. This process may 
continue until one reaches the 9th letter and compares it with the 10th, yielding but one oppor- 
tunity for the occurrence in question The total number of comparisons that can be made is 
therefore the sum of the series of numbers 9, 8, 7, . 1, which is 45 comparisons 2 Since m 

the 10 letters there are 45 opportunities for comcidence of single letters, and smce the probability 



* The expression itself may be termed a parameter, which m mathematics is often used to designate a constant 
that characterizes by each of its particular values some particular member of a system of values, functions, etc 
The word is applicable in the case under discussion because the value obtained fore, is 0385, for a 25-element 
alphabet, *,= 0400; for a 27-element alphabet, «,== 0370, etc 

1 The number of comparisons may readily be found by the formula ~ > where n is the total number 

of letters involved This formula is merely a special case under the general formula for ascertaining the number 

of combinations that may be made of n different things taken r at a time, which is »C r = -^ w ^ r p In the 

present case, since only two letters are compared at a time, r is always 2, and hence the expression ^ ^_ T y ' 
which is the same as becomes by cancellation of the term (n— 2)' reduced to n ^" 2 — 
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for monographic coincidence in random text is .0385 the expected number of coincidences is 
.0385X45=1.7325 With m= 1.7 one consults the various probability curves and an approxi- 
mate distribution for exactly and for at least 0, 1,2, . . . coincidences may readily be ascertained. 4 

e. (1) Now consider the matter of monographic coincidence in English plain text. 4 Follow- 
ing the same reasoning outlined in subpar. d (1), the probability of coincidence of two A’s in plain 
text is the square of the probability of occurrence of the single letter A in Buch text. The 
probability of coincidence of two B’s is the square of the probability of occurrence of the single 
letter B, and so on The sum of these squares for all the letters of the alphabet, as shown in 
the following table, is found to be .0667. 



Letter 


Frequency > In 
1,000 letters 


Probability of sep- 
arate occurrence 
of the letter 


Square of proba- 
bility of apente 
occurrence 


A _. ... 


73 66 


0 0737 


0 0054 


B__ ..... __ 


9 74 


. 0097 






30 68 






D 


42 44 


. 0424 


TS 


E 


129 96 




. 0169 


F 


28 32 




. 0008 


G 


16 38 


. 0164 


0003 


H . 


33. 88 


0339 


a fpa 


I 


73. 52 


0735 


m&tr* wW 


J. 


1 64 




. 0000 


K . 


2 96 




. 0000 




36 42 


0364 


. 0013 




24 74 


0247 


. 0006 


11 


79 50 


B 


. 0063 


0. 


75 28 


B 


. 0057 


P. . . 


26 70 


B 


0007 


q 


3 50 


?B 


0000 


R ... 


75 76 


. 0758 


.0057 


s 


61 16 


. 0612 


. 0037 




91 90 


. 0919 




u 


26 00 




. 0007 


V 


15. 32 


. 0153 


. 0002 


ff - 


15 60 


0156 


0002 


X. _ 


4 62 


. 0046 


0000 


Y 


19 34 


. 0193 


. 0004 


z . 


98 




. 0000 


Total ._ 


1,000 00 


1 0000 


.0667 


1 The data given are taken from Table 3, Appendix 1, Military Cryptanalysis, Fart I 



This then is the probability that any two letters selected at random in a large volume of 
normal English telegraphic plain text will coincide. Since this value remains the Bame so long 
as the character of the language does not change radically, it may be said that the probability 
of monographic coincidence in English telegraphic plain text is .0667, or k p =.0667. 

4 The approximation given by the Poisson distribution in the ease of single letters is not as good as that 
in the case of digraphs, tngraphs, etc , discussed in paragraphs 3, 4, below. 

* The theory of monographic coincidence m plain text was originally de\ eloped and applied by the author 
in a technical paper written m 1925 dealing with his solution of messages enciphered by a cryptograph known 
as the "Hebern Electric Super-Code ” The paper was printed in 1934. 
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(2) Given 10 letters of English plain text, what is the probability that there will be 0, 1, 

2, .. . single-letter coincidences? Following the line of reasoning in subparagraph d (2), the 
expected number of coincidences is 0667X45=3.00, or m= 3. The distribution for exactly and 
for at least 0, 1, 2 , . . . coincidences may readily be found by reference to the various probability 
curves. (See footnote 4 ) 

j. The fact that k p (for English) is almost twice as great as <c r is of considerable importance 
in cryptanalysis. It will be dealt with in detail in a subsequent text. At this point it will mere- 
ly be said that *, and k, for other languages and alphabets have been calculated and show con- 
siderable variation as will be noted in the table shown in paragraph 3d 

3. Data pertaining to digraphs . — a (1) The foregoing discussion has been restricted to 
questions concerning single letters, but by slight modification it can be applied to questions 
concerning digraphs, tngraphs, and longer polygraphs 

(2) In the preceding cases it was necessary, before referring to the various probability 
curves, to find the mean or expected number of occurrences of the event in question in the 
total number of cases or tnals being considered. Given a piece of random text totalling 100 
letters, for example, what is the mean (average, probable, expected) number of occurrences of 
digraphs in this text? Since there are 676 different digraphs, the probability of occurrence 

of any specified digraph is g^g=.00148; since in 100 letters thore Are 99 digraphs (if the letters 

are taken consecutively in pairs) the mean or average number of occurrences in this case is 
00148X99= 147. Having the mean number of occurrences of the event under consideration, 
one may now find the answers to these questions' What is the probability that any specified 
digraph, say XY, will not occur? What is the probability that it will occur exactly 1, 2, 

3, . . . times? At least 1, 2, 3, . . . times 7 

(3) Again the probability curves may be used as before, for the type of distribution is the 
same. The following values are obtainable by reference to the various curves, using the mean 
value .00148X99=. 147. 

100 Utters of random text 



Frwgancy 


Probability that 
a specified digraph 
will occur exactly 
z times 


Probability that 
a specified digraph 
will occur at least 
x times 


Probable number 
of digraphs ap- 
pearing exactly 
x times 


Probable number 
of digraphs ap- 
pearing at least 
x times 


0 


0 86 


1 00 


581 36 


676 00 


1 


.18 


14 


87.88 


94.64 


2 


.01 


.01 


6.76 


6.76 


3 


00 


00 


0 00 


0.00 



(4) Thus it is seen that m 100 letters of random text the probability that a specified digraph 
will occur exactly once, for example, is 13 ; at least once, .14, at least twice, .01. The probability 
that a specified digraph will occur at least 3 times is negligible (By calculation, it is found to 
to be .0005 ) 

b. (1) The probability of digraphic coincidence in random text based upon a 26-element 
alphabet is of course quite simply obtained: since there are 26 2 different digraphs, the probability 



of selecting any specified digraph in random text is ^ The probability of selecting two iden- 
tical digraphs in such text, when the digraphs are specified, is Since there are 26* 

different digraphs, the probability of digraphic coincidence in random text, kj, is 26*X2^i= ^2— 



00148 . 
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(2) Given a random assortment of 100 letters, what is the probability of occurrence of 
0, 1, 2, digraphic coincidences? Following the line of reasoning in paragraph 2d (2), in 
100 letters the total number of comparisons that may be made to see if two digraphs coincide 
is 4,851 This number is obtained as follows Consider the 1st and 2d letters in the series of 
100 letters, they may be combined to form a digraph to be compared with the digraphs formed 
By combining the 2d and 3d, the 3d and 4tli, the 4th and 5th letters, and so on, giving a total of 
98 comparisons. Consider the digraph formed by combining the 2d and 3d letters; it may be 
compared with the digraphs formed by combining the 3d and 4th, 4th and 5th letters, and so on, 
giving a total of 97 comparisons This process may be continued down to the digraph formed 
by combining the 98th and 99th letters, which yields only one comparison, since it may be 
compared only with the digraph resulting from combining the 99th and 100th letters. The 
total number of comparisons is the sum of the sequence of numbers 98, 97, 96, 95, . . 1, which 
is 4,851 • 

(3) Since in the 100 letters there are 4,851 opportunities for the occurrence of a digraphic 
coincidence, and since k,*— 00148, the expected number of coincidences is 00148X4851 = 
7.17948=7 2 The various probability curves may now be referred to and the following results 
are obtained 

Distribution for 100 letters of random text 



Frequency (z) 


Probability for exactly r 
digraphio coincidences 


Probability for at least z 
dtgraphlc coincidences 


0 


0 001 


1 000 


1 


005 


999 


2 


019 


994 


3 


046 


975 


4 


083 


.929 


5 


120 


846 


6 


144 


726 


7 


148 


582 


8 


134 


434 


9 


107 


. 300 


10 


077 


193 


11 


050 


116 



e In this table it will be noted that it is almost certain that in 100 letters of random text 
there will be at least one digraphic coincidence, despite the fact that there are 676 possible 
digraphs and only 99 of them have appeared m 100 letters When one thinks of a total of 676 
different digraphs from which the 99 digraphs may be selected it may appear rather incredible 
that the chances are better than even (.582) that one will find at least 7 digraphic coincidences in 
100 letters of random text, yet that is what the statistical analysis of the problem shows to be 
the case. These are, of course, purely accidental repetitions. It is important that the student 
should fully realize that more coincidences or accidental repetitions than he feels intuitively 
should occur m random text will actually occur in the cryptograms he will study. He must 
therefore be on guard against putting too much reliance upon the surface appearances of the 
phenomena of repetition; he must calculate what may be expected from pure chance, to make 
sure that the number and length of the repetitions he does Bee in a cryptogram are really better 
than what may be expected in random text. In studying cryptograms composed of figures this 

* The formula for finding the number of comparisons that can be made is as follows, where n— the total number 
of letters in the sequence and t is the length of the polygraph .Since the number of polygraphs possible is 
n— 1+1, the number of comparisons is 

(n-t+l) (n-t) 

2 

lie cause any one of the n— 1 + 1 polygraphs may be compared with any one of the remaining n— f but as a com- 
parison of A with B is the same as a comparison of B with A, the product must be halved. 
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is very important, for as the number of different symbols decreases the probability for purely 
chance coincidences increases. 

d. (1) For convenience the following values of the reciprocals of various numbers from 20 to 
36, and of the reciprocals of the squares, cubes, and 4th powers of these numbers are listed: 



X 


V* 


l/i' 


W 


i/i* 


20 




0. 002500 


0 000125 


0 00000625 


21 


0476 


. 002266 


000108 


. 00000514 


22 




002070 


000094 


. 00000429 


23 


0435 


. 001892 


. 000082 


00000358 


24 


.0417 


. 001739 


000073 


. 00000302 


25 




.001600 


000064 


. 00000256 


26 




. 001482 


. 000057 


00000220 


27 




. 001369 


000051 


. 00000187 


28 




. 001274 


000046 


00000162 


29 


.0345 


001190 


. 000041 


. 00000142 


30 


■ F . Mm 


.001109 


. 000037 


. 00000123 


31 




. 001043 


000034 


. 00000109 


32 




. 000080 


000031 


. 00000096 


33 




. 000918 


000028 


. 00000084 


34 




000864 


. 000025 


. 00000075 


35 


l§§»‘ 


000818 


.000023 


00000067 


36 


0278 


000773 


000021 


00000060 



(2) The following table gives the probabilities for monographic and digraphic coincidence 
for plain-text in several languages. 



LantuAga 






English 






French 






German- - - _ 




Ki I 


Italian 


.0738 




Spanish 


0775 


0093 





4. Data pertaining to trigraphs, etc . — a Enough has been shown to make clear to the student 
how to calculate probability data concerning tngraphs, tetragrapha, and longer polygraphs. 

b. (1) For example, in 100 letters of random text the value of m (the mean) for tngraphs 
is .00005689X100 = 005689. With so small a value, the probability curves are hardly usable, 
but at any rate they show that the probability of occurrence of a specified trigraph in so small 
a volume of text is so small as to be practically negligible. The probability of a specified trigraph 
occurring twice in that text is an even smaller quantity. 

(2) The calculation for finding the probability of at least one trigraphic coincidence in 100 
letters of random text is as follows: 



m= ^97X98^_l_^ =4753X >0000568912= .2704= .27 



Referring to curve / 0> with m=.27 the probability of finding no trigraphic coincidence is .76. 
The probability of finding at least one trigraphic coincidence is therefore 1— .76= 24 
c. The calculation for a tetragraphic coincidence is as follows. 



to= (?6X97^_1_^ =4j656x 00000 2 18 83= . 01 01= .01 

Referring to curve jo, with m=.01 the probability of finding no tetragraphic coincidence is 
so high as to amount almost to certainty. Consequently, the probability of finding at least 
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one tetragraphic coincidence is practically nil. (It is calculated to be 0094 = approximately .01. 
This means that in a hundred cases of 100-letter random-text cryptograms, one might expect 
to find but one cryptogram in which a 4-letter repetition is brought about purely by chance; it 
is, in common parlance, a “hundred to one shot ”) Consequently, if a tetragraphic repetition 
is found in a cryptogram of 100 letters, the probability that it is an accidental repetition is 
extremely small. If not accidental, then it must be causal, and the cause should be ascertained. 

5. An example. — a. The message of Par 9a of the text proper will be employed. First, let 
the repetitions be sought and underlined , then the repetitions are listed for convenience 



A. 


U S Y E S 


E C 


P 


M 


P 


L 


C C L N 


X B W C S 


0 X U V 


D 


B. 


S C R H 


T 


H X 


I 


P L 


I 


B C I J 


U S Y E E 


G U R D 


P 


C. 


A Y BJL 


X 


0 F 


P 


J 


W 


J 


EHGP 


X V E U E 


L E J Y 


Q 


D. 


u use 


X 


J Y M S 


G 


L L E T A 


L E D E C 


G B M F 


I 



Group 


Number of 
occurrences 


BC 


2 


CX 


2 


EC 


2 • 


LE 


3 


JY 


2 


PL 


2 


SC 


2 


SY 


2 


US 


3 


YE 


2 


SYE 


2 


USY 


2 


USYE 


2 



6. Referring to the table in Par 3a (3) above, it will be seen that m 100 letters of random 
text one might expect to find about 7 digraphs appearing at least twice and no digraph appearing 
3 times The list of repetitions shows 8 digraphs occurring twice and 2 occurring 3 times. 

e Again, the list of repetitions shows 10 digraphs each repeated at least twice; the table in 
Par. 36 (3) above shows that in 100 letters of random text the probability of finding at least 
that many digraphic coincidences is only 193 That is, the chances of this being an accident are 
but 176 m a thousand ; or another way of expressing the same thing is to say that the odds against 
this phenomenon being an accident are as 807 is to 193 or roughly 4 to 1. 

d. The probability of finding at least one tngraphic coincidence in 100 letters of random 
text is very small, as noted in Par 46, the probability of finding at least one tetragraphic coin- 
cidence is still smaller (Par 4c) Yet this cipher message of but 100 letters contains a repetition 
of this length 

« A consideration of the foregoing leads to the conclusion that the number and length of the 
repetitions manifested by the cryptogram are not accidental, such as might be expected to occur 
in random text of the same length; hence they must be causal m their origin. The cause in this 
case is not difficult to find repeated isolated letters and repeated sequences of letters (digraphs, 
trigraphs) in the plain text were actually enciphered by identical alphabets, resulting in producing 
repeated letters and sequences in the cipher text. 
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Appendix 3 

A GRAPHICAL METHOD OF RECONSTRUCTING PRIMARY COMPONENTS BY 
APPLYING THE PRINCIPLES OF INDIRECT SYMMETRY OF 

POSITION 1 

1. Fundamental theory.— a It lias been shown that the interval between letters of a 
sequence obtained from a secondary alphabet is a constant function of the interval separating 
the letters in the original pi unarv component Consider the following sequence 

QUESTIONABLYCDFGHJKMPRVWXZ 

Assume that this component is slid against itself and that the following groups of partial sequences 
are obtained from three secondary alphabets 

Group 1— S T I; HE, N A 
Group 2— I N, E T; 0 A 
Group 3— T N; Q S 0 

Figure 1 

Refeirmg to the primary component, it will be seen that the letters of the partial sequences 
obtained from gioup 1 coincide in their interval with that in the primtuy component, the letters 
of the paitial sequences obtained fiom group 2 represent a decimation interval of two in the 
primary component, and those obtained from group 3, a decimation interval of tlnee 

b In the foregoing case, decimation was accomplished by taking intervals to the right 
along a horizontal component Given Figure 2 below, let a portion of that square table or 
matrix be considered, ns shown in Figure 3 

1 The basic theory underlying this modified method of applying the principles was set forth in a brief paper 
(November 5, 1941) by 1st Lieut Paul E Neff, Sig C To his original notes, which 1 have slightly modified 
for purposes of clarification, I have also added the matter contained in Pars 3e and / 
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1 3 3 4 5 6 7 8 « 10 11 12 13 14 15 13 17 18 1# 20 21 22 23 84 25 33 

QUESTIONABLYCDFGHJKMPRVWXZ 

UESTIONABLYCDFGHJKMPRVWXZQ 

ESTIONABLYCDFGHJKMPRVWXZQU 

STIONABLYCDFGHJKMPRVWXZQUE 

TIONABLYCDFGHJKMPRVWXZQUES 

IONABLYCDFGHJKMPRVWXZQUEST 

ONABLYCDFGHJKMPRVWXZQUESTI 

NABLYCDFGHJKMPRVWXZQUESTIO 

ABLYCDFGHJKMPRVWXZQUESTION 

BLYCDFGHJKMPRVWXZQUESTIONA 

LYCDFGHJKMPRVWXZQUESTIONAB 

YCDFGHJKMPRVWXZQUESTIONABL 

CDFGHJKMPRVWXZQUESTIONABLY 

DFGHJKMPRVWXZQUESTIONABLYC 

FGHJKMPRVWXZQUESTIONABLYCD 

GHJKMPRVWXZQUESTIONABLYCDF 

HJKMPRVWXZQUESTIONABLYCDFG 

JKMPRVWXZQUESTIONABLYCDFGH 

KMPRVWXZQUESTIONABLYCDFGHJ 

MPRVWXZQUESTIONABLYCDFGHJK 

PRVWXZQUESTIONABLYCDFGHJKM 

RVWXZQUESTIONABLYCDFGHJKMP 

VWXZQUESTIONABLYCDFGHJKMPR 

WXZQUESTIONABLYCDFGHJKMPRV 

XZQUESTIONABLYCDFGHJKMPRVff 

ZQUESTIONABLYCDFGHJKMPRVWX 

FlQUBC 2 



Column No 1234567 8 

Q [uj E [sl T I 0 In 

u[e]stion[a 

est[i|onab 

STIONABL 

(a) 

Column No 12345S7B 

(q]ues[t]ion 
U— E-[ s] T I— 0 -[nJ A 
E S T— l-[0j NAB 
STIONABL 
TIONABLY 



1 2 3 4 6 A 



Q U ffil S T m[0\ N 



U E S |T| I 0 |NJ [Aj 
ESTIONAB 

STIONABL 

(b) 

13345678 

[QlUESfTllON 



&-{s] T I 0-[N] A B 
STIONABL 
T i-j0] N A B L Y 



1 



f 



figure 3 
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c Again referring to Figure 1, the partial sequences STI, UE, and NA can be obtained from 
Figure 3(a) by reading down columns 4. 2, and 8, respectively This can be represented 
graphically by the symbol j, 1, which means that all partial sequences obtained from Figure 
3 fa) by proceeding downward in any column would be m the same group (i. e . secondary 
alphabet) and have the same decimation interval 

d The partial sequences IN, ET, and OA can be represented graphically by 1 L>, or simply 

1 

\1, which indicates that all partial sequences obtained by taking letters one space down and 
one space to the right, or one space down a diagonal to the right would represent the same 
decimation interval 

e The partial sequences TN and QSO can be represented by the symbol 1 1-*., but they can 

2 

also be represented by 2 1_» and, if the entire matrix of Figure 2 is considered, by other possible 
routes. 

i The decimation interval of a secondary sequence derived from a ■primary is the sum of the 
horizontal and vertical components of the route selected Since the partial sequence TN can be 
represented by 1 L», the decimation interval of this sequence is equal to the vertical decimation 
2 

interval of the basic square plus twice the horizontal decimation interval in that square Any 
other route selected for the same sequence would give an equivalent of this 

g It is seen, therefore, that the decimation interval of a component can be represented 
graphically in various ways other than along the horizontal, by use of diagrams such as m 
Figure 3, in which the successive juxtaposed components have the same relative displacement 
In this case the successive horizontal lines had a one-letter displacement to the left 

h Not being limited to one dimension, reconstruction of the primary component or an 
equivalent should be possible m one combined matrix by reversing the foregoing process and 
graphically integrating partial sequences from different secondary alphabets into a single 
diagram. Suppose the partial sequences m Figure 1 are given and it is desired to reconstruct 
the primary component 



Group 


1 


2 


3 




[STI 


I N 


T N 


Partial aequences . _< 


U E 

In a 


E T 
C A 


QSO 




1 


U 


M 



Figure 4 



i (1) Using cross-section paper one can arbitrarily select the STI sequence in group 1 and 
write this sequence horizontally, making the graphical notation below group 1 

1 

(2) Proceeding to group 2, the partial sequence IN contains one letter in common with 
the sequence STI already entered, but smee NA forms a sequence m group 1 and OA forms a 
sequence m group 2, it is clear that two different decimations are involved and therefore it 
would be incorrect to integrate the STI and the IN into STIN However, the letter N can 
arbitrarily be placed m any position other than along the hoi izontal line on which STI has been 
placed It will be placed directly below the letter I and the group will be denoted graphically 
by J,l, giving 

STI 
. . N 

Figure 4 (a) 
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(3) Tlie skeleton of the matrix or diagram is now fixed in two dimensions, and no further 
letters can be arbitrarily placed within it However, additional sequences from groups 1 and 2 
can be added, provided a common letter is available m the diagram, sequences from other 
groups can be added, provided one pair is already entered in the diagram which would fix the 
proper graphical decimation 

(4) Moving to group 3, there is the partial sequence TN and it is noted that this pair of letters 
is present in the diagram The symbol \1 can tlieiefore be placed under group 3 

(5) In group 3 the partial sequence QSO appears, and the letter S is in the diagram It 
therefore follows that the letters Q and 0 can be placed thus 

(1) Q - . • 

(2) . S T I 

(3) . .ON 

FiauRi 4 (b) 

(6) Similarly the letter E of the paitial sequence ET in group 2 goes directly above the T 

(1) Q . E . 

(2) S T I 

(3) . .ON 

FiauRE 4 (c) 

(7) The letter U of the sequence UE m group 1 goes before the E 

(1) Q U E . 

(2) . S T I 

(3) . .ON 

Figure 4 (d) 

(8) Likewise the letter A of NA in group I follows N 

(1) Q U E . . 

(2) . S T I . 

(3) . . 0 N A 

Figure 4 (e) 

(9) The sequence OA in group 2 remains to be entered Since both these letters arc already 
in the diagram, the letter A can be placed under the existing 0 or the letter 0 can be placed 
above the existing A Either alternative would be correct Selecting the latter alternative 
yields the following 

(1) Q U E . . 

(2) S T I 0 

(3) . . 0 N A 

Figure 4 (0 

j All the original information has now been entered m the diagram seen in Figure 4 (f) 
and the letter 0 appears twice therein This letter 0 may be termed the "tio-m” letter since it 
indicates the horizontal interval between the juxtaposed reconstructed sequences of the basic 
matrix The absence of a tie-in letter m the diagram would indicate that insufficient data are 
present for the reconstruction of a complete sequence 

k (1) By sliding the last row of Figure 4 (f) two intervals to the right the two 0’s can be 
superimposed, giving 

(1) Q U E . . 

(2) . S T I 0 . . 

(3) . . . . 0 N A 

Figure 4 (g) 
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(2) Since each horizontal sequence must be shifted two intervals to the right of its initial 
position m relation to the line above, row (l) must be moved two intervals to the left of its ori ginal 
position Thus 

(1) Q U E 

(2) . . . S T I 0 . . 

(3) 0 N A 

Flora* 4 (h) 



(3) Since the three rows involve the same decimation, and since the 0 of ONA coincides 
with the 0 of STIO, the ONA sequence may be raised up one row and united with the STIO 
sequence If this is legitimate then the new row (2) may likewise be raised up one row This 
yields the united sequence QUESTIONA . . . This last step may be more clearly understood by 
studying the following partially reconstructed matrix 




(1) [Q u E[ 

(2) EjS T I 01 

(3) T ij 0 N A| 

(4) 



2. Application of principles . — a For the specific application of the principles underlying 
this method reference is made to the problem described m Section VIII of the text It is desired 
to reconstruct the original primary component, or an equivalent, from the values entered in the 
reconstruction skeleton shown in Figuic 33, page 68 Since a mixed sequence is sliding against 
itself, all the partial sequences (pairs or greater) which can be established by studying the 
reconstruction skeleton are listed as shown in Figure 5(a) The single pairs in 0-7 and 0-8 are 
crossed out since they offer no data for reconstruction This yields the following groups of 



partial sequences 

»- i 


2 


3 


4 


5 


e 


7 8 « 


10 


BW 


EK 


EX 


AE 


ED 


EJ 


-ye- -ee- ihj 


HE 


EGZ 


HZ 


TU 


HG 


HCR 


GN 


TS 


IV 


GZ 


NS 




10 


NP 


HOF 


WA 


NQ 


TK 


UF 




TP 


Flora* S (a) 







b. (1) The sequences HOF and EJ m group 6 and HE in group 10 are noted. The HOF will 
be placed horizontally and the notation _> made under group 6 The letter E of the pair HE 

1 

of group 10 will be placed under the H, and the notation J, 1 added under group 10. Thus* 



i 


2 


3 


4 


» 


t 


7 8 0 


10 


BW 


EK 


EX 


AE 


ED 


EJ 


-w -oe- ihj 


HE 


EGZ 


HZ 


TU 


HG 


HCR 


GN 


TS 


IV 


GZ 


NS 




10 


NP 


HOF 


WA 


NQ 


TK 


UF 




TP 




—> 
















1 




jl 



Flora* 5 (b) 



Since the sequence EJ belongs to the same displacement interval as HOF, the letter J can be 
inserted after the letter E, giving. 

HOF 
E J . 

Frau** ( (a) 
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No more pairs can be immediately added from groups 6 or 10 Those pairs already entered are 
crossed out in their respective groups and an inspection is made for additional data m another 
group 

(2) The sequence IHJ is noted in group 9. The letters H and J are already entered m the 
diagram One can therefore place the letter I, and the notation \1 is placed under group 9. 
The addition of the letter I now permits the insertion of the letter V of the sequence IV in group 
10, giving- 

I . . . 

V H 0 F 

. E J . 

Fioirai 8 (b) 

(3) In group 4 there is the sequence 10 which is obtainable in the diagram by the route 1 1_> 

2 

This notation is made beneath group 4, the letter A of the sequence AE and the letter G of the 
sequence HG can now also be entered The addition of the letter A permits the placement of 
the letter ff of the pair WA of group 9, likewise the addition of the letter G permits the insertion of 
the letter N of the sequence GN of group 6, finally, the placement of the letter N permits the 
placement of the Q of group 9 One now has 

ff • I • . 

. A V H 0 F . 

. . . E J G N 
. • Q 

Figure e (e) 

(4) Referring to group 1, the sequence EGZ is noted, of which EG appears in the diagram 
at The letter Z can therefore be placed and the letter B of the sequence Bff can be inserted 

2 

two intervals to the left of the letter W. giving 



B . W I . 

. . . A V H 0 F . . 

E J G N Z 

Q . 

Fioure 6 (d) 



(5) Noting the sequence HZ of group 2 as being graphically represented m the diagram by 1 1_», 

4 



the letters K, S and U of the sequences EK, NS and UF may be placed. Thus 



B.WUI 

. . . A V H 0 F . . . 

EJGNZ 

QK..S 



Figure 8 (e) 
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(6) The letter T of the sequence TK of group 1 can now be placed, which permits the addi- 
tion of the letter P of the sequence TP of group 4 A study of the diagram shows the pair TU 
of group 3 tit interval 3t_, which allows the placing of the letter X of the pair EX of the same 
4 

group One then has 



X 

B . W U I 

. . . AVHOF 

EJGNZ... 

TQK..S 

P . . . 

figure e co 

(7) The diagram now shows the pair NP of group 5 at 2 1_» The letter D of the sequence 

1 

ED and the letters C and R of HCR can therefore be inserted Thus* 

.X 

B WUI 

. . .AVHOF 

EJGNZ. . . 

CTQK..S 

D . . P . . . 

R 

Figure 8 (g) 

(81 Pair TS of group 9 remains It has already been noted that the notation \1 has 
been applied to group 9 Hence the letter S can also be placed one interval to the right and 
below the T, as shown in Figure 6 (h), in which all the available data are now entered 

(1) . X 

(2) B . W U I 

(3) . . .AVHOF 



(4) EJGNZ. . . 

(5) C T Q K . . S 

(6) D . S P 

(7) R 



Figure 6 (h) 



517974 0 - 43 -9 
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e. (1) The letter S appears in rows (5) and (6) at a displacement interval of four. This 
letter then serves as the “tie-in” letter Marking off 26 squares on cross-section paper the 
D.SP of row (6) is written, and row (5) is moved four intervals to the left, at which position 
the letter S is properly superimposed as follows. 

1 2 3 4 t 8 7 8 « 10 11 12 13 14 IS It 17 18 19 2D 21 22 23 2t 2S 28 

Row (5) C T Q K . . S . 

Row (6) . . . .D.SP 

(2) Likewise row (4) is moved four intervals to the left of its original relative position to 
row (5) and dropped into position Row (3) is moved the same distance in relation to row (4), 
etc These steps may be illustrated as follows- 

1 2 8 4 t 8 7 8 9 10 11 12 18 14 IS 18 17 18 19 20 21 22 23 24 28 28 

Row (4) . . . . E J G N Z CTQKD.SP 

Row (3) HOF . EJGNZCTQKD . SP A_V 

Row (2) HOF . EJGNZCTQKD . SP B , BUT . . A V 

(3) The placing of the letter X of row (1 ) and the letter R of row (7) gives the final sequence* 

1 2 3 4 S 8 7 8 9 10 11 12 13 14 IS 18 17 18 19 20 21 22 23 24 28 28 

HOF EJGNZCTQKDXSPBRWUI. AV 

(4) It will be noted that the foregoing component is identical with that obtained in sub- 
paragraph m(3), page 74 of the text 

3 Remarks. — a In the example given above only one tie-in letter was available and it was 
located in adjacent rows Although only one is necessary, m most cases several tie-in letters 
are present after all pairs of letters have been entered in the diagram , then the superimposed 
sequences can be easily connected by their common letters If the tie-in letter had appeared 
in adjacent columns instead of adjacent rows as m the foregoing example, the columns would 
have been shifted vertically and the sequence taken from the diagram in that manner 

b When only a few pairs of letter forming partial sequences are available, frequently only 
one tie-in letter may be encountered If it does not occur m adjacent rows or columns the com- 
ponent can still be written with additional considerations For example, adjacent diagonals 
might be used However, the student will experience no difficulty after the application of this 
method to a few problems 

c Since all the data arc entered in one diagram, the graphical method of reconstruction 
quickly discloses erroneous assumptions and enables one to ascertain m a short time whether 
sufficient data are present for the reconstruction of the component Even if this is not the case, 
the diagram automatically offers new values which may be substituted m the cryptogram One 
may then assume additional values which can be entered in the diagram or which wdl serve to 
corroborate sequences already entered. 

d The placing of the first two sequences of different displacement intervals in the diagram 
determines the type of sequences that will be established If the original sequence entered 
horizontally m the diagram is an odd decimation of the primary component, a 26-letter sequence 
can be obtained horizontally If this original sequence is initially tied in vertically with another 
sequence of an odd decimation interval, a 26-letter sequence can also be obtained vertically 
from the diagram 
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e. (1) In certain instances, however, it will happen that the available partial sequences 
have all resulted from even decimations of the basic sequence and that no tie-in letters are present 
to permit the integration of all the data into a single diagram In such cases the reconstruction 
of the basic sequence may take place by taking data from two or more different diagrams, and 
then, using the relative positions of the letters with respect to each other in these diagrams, the 
basic sequence may be established. This method can best be demonstrated by means of an 
example, and the following one is based upon the QUEST . . sequence of paragraph la Suppose 
the reconstruction diagram from the derivation of a few plain text-cipher relationships yields the 
following partial sequences 

Group 12 3 



Sequences ■ 



Q H 0 
F T 
C E 
J N 
OS 



Q X V Q T A 

0 T X E 

P K F K 

F C U I B 

U Z W Z S 

N I Y G M 

G D 



Fiona* 7 



(2) The partial sequences in the three groups can be combined to form two diagrams. 
This may be accomplished by considering the sequences of group 1 as parts of a horizontal com- 
ponent and those of group 2 as parts of a vertical component of a cipher square based upon the 
original or an equivalent primary sequence. When all the letters of these two groups have 
been entered into the two resultant diagrams in Figure 8 (a) and (b), it will be observed that the 
positions occupied in these two diagrams by the letters of group 3 represent the interval 1 1_*. 

2 

Thus: 



Q H 0 . . 
X F T P . 
V C E K A 



Y U J N 
. Z G I . 
OSHB 



(a) 



Fiou« B 



00 



(3) It will be noted that there are 12 letters in each of the two diagrams and that all the 
letters appearing in the original partial sequences have been included in these two groups It 
appears, first, that two 13-letter sequences are involved and second, that the partial sequences in 
all three groups represent even decimations of the basic component The problem now remains 
to reconstruct the original or an equivalent primary cipher square to which these diagrams belong, 
or to find the original or an equivalent component of which the partial sequences in groups 1, 2, 
and 3 are derivatives 

(4) Since the two diagrams are linked by the partial sequences of group 3 (because the 
interval 1 1_» is common to both of them), it follows that any two letters in one of the diagrams 

2 

will be separated from each other in the basic sequence by the same interval as any two letters 
occupying the same relative positions in the other diagram. Another way of saying the same 
thing is, that while the intervals between V and C, C and E, E and K, and K and A, in the basic 
component (Or an equivalent thereof) are unknown, whatever they are they are identical and the 
same as that between W and D, D and S, S and M, M and B (from WDSMB), or between Y and U, 
U and J, J and N (from YUJN), and so on. Likewise, Q and K (interval 2 1_>) are separated by the 
same interval as Y and S, or U and M, and bo on. 3 
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(5) Making the easiest assumption first, suppose the basic sequence is a keyword-mixed 
sequence, and that the letter Z is the final letter thereof. If it is preceded by Y, then, because of 
the relative positions occupied by Y and Z in Figure 8 (b), the following would also be sequent 
in the basic sequence QF, HT, OP, XC, FE, TK, PA, UG, JI, ZD, GS, and IM Since the majority 
of these are hardly likely to occur in a keyword-mixed sequence, the assumption that Y precedes 
Z is discarded Suppose X precedes Z (implying that Y is m the keyword) But X and Z are not 
m the same diagram, so no test can be ma'de Suppose the sequence is W . Z. Then the 
following sequences would be valid 



W Z . U V . X . Q 

D G . J C . F . H 

S . I . N E . T . 0 

K . P 



These look veiy likely In fact, noting the D . G J and the C F . H sequences it seems logical to 
integrate or “dovetail” them thus CDFGHJ This then suggests that ff Z.U and V X.Q may 
be integrated into VWXZQU , S . I N and E . T . 0 may be integrated into ESTION From this 
point on the matter of extending the partial sequences into the basic one is simple and rather 
obvious 

j (1) Suppose, however, that the basic sequence is not a keyword-mixed sequence, so that 
clues of the nature of those employed in the preceding subparagraph are no longer available. 
Then what? 

(2) Referring back to subparagraph d (3), it has already been noted that the two diagrams, 
each containing 12 letters, represent half-sequences (of 13 letters) derived from an even decima- 
tion of the original component (The decimation must be the Bame in both cases because the 
interval 1 1_ is common to them ) Suppose an attempt is made to integrate the QHO, XFTP, and 

2 

VCEKA sequences of Figure 8 (a) into a 13-letter cycle or half-sequence The three partial 
sequences in this diagram may be united into a 13-letter cycle m a number of ways but the 
correct integration will be that which will satisfy all the conditions set up by the partial sequences 
in groups 1, 2, and 3 After a bit of experimentation it is found that the only one which will 
satisfy all conditions is this 

1 2 J 4 I 8 7 8 9 10 11 12 IS 

QHOVCEKAXFTP . 

Note, for example, that the conditions represented by QXV m group 2 are satisfied m that the 
intervals between these letters are the same m the 13-letter cycle, the same is true as regards the 
intervals between 0 and T, P and K, and so on Likewise, the conjugate sequence from Figure 8 
(b) is established as 

1 ! 1 I 1 I 7 I I 10 II 11 1! 

YUJNWDSMBZGI . 

Thus there have been established the two half-sequences involved. The problem now remains 
to integrate them into a single sequence which is either the primary or an equivalent basic 
component 

(3) Each of these sequences may, of course, be expanded to form a 26-element sequence the 
elements of which will satisfy the interval relationships among the letters in each 13-letter 
sequence. Thus. 

1 2 a 4 t < 7 8 8 10 (1 12 12 14 18 18 17 IS 18 20 21 22 21 34 28 28 

(1) Q.O.C.K.X.T. . .H.V.E.A.F.P. 

(2) Y.J.V.S.B.G. . .U.N.D.U.Z.I. 

no vico 
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There remains the problem of integrating these two sequences into a single sequence 

(4) Suppose a start is made thus 

1 2 3 * 8 8 7 g 6 10 11 12 13 14 15 16 17 lg 12 20 21 22 23 24 25 28 

QYOJCWKSXBTG . . HUVNEDAMFZPI 

Fioube 10 

All the interval relationships of groups 1, 2, and 3 of Figure 7 are satisfied by this sequence If 
the sequence is written on a pair of sliding strips, any even-interval displacement of one of the 
strips will produce plain text — cipher relationships fully satisfied by the requirements of the 
sequences in Figure 7 or Figure 8 Thus 

m QYOJCWKSXBTG. .HUVNEDAMFZPI 

HUVNEDAMFZPIQYOJCWKSXBTG. . 

QYOJCWKSXBTB. .HUVNEDAMFZPI 
{) XBTG. . HUVNEDAMFZPIQYOJCWKS 

QYOJCWKSXBTG. .HUVNEDAMFZPI 
W TG. HUVNEDAMFZPIQYOJ CWKSXB 

Figure n 

The foregoing three juxtapositions will satisfy all the requirements of the sequences indicated in 
groups 1, 2, and 3 of Figure 7, as well as those indicated m Figures 8 (a) and (b) Without further 
restrictions or additional data, therefore, it is impossible to tell whether the reconstructed single 
sequence is correct or not In fact, there are 13 possible integrations of the two expanded 13- 
letter sequences which will yield equivalent results, Bince there are 13 positions in which the 
“dovetailing” of the second sequence may be commenced with respect to the first sequence Only 
one of these, however, will be correct in that it will yield a single sequence which, when slid 
against itself at all juxtapositions (both odd and even displacements) will invariably yield the 
full quota of plain text — cipher relationships that the original basic or an equivalent primary 
component yields when slid against itself (An incorrect integration will often yield a series of 
equivalents of which only a few are wrong ) 

(5) The correct integration will, however, be disclosed quickly enough when the cipher text 
is consulted and one or two additional values are derived Thus, suppose an additional word is 
deciphered and it yields a pair of values in a new secondary alphabet, for example, A p =D e and 
U B =0 o The single sequence reconstructed as shown in Figure 10 will not yield this pair of 
values, as seen in the following juxtaposition of the sliding strips 

QYOJCWKSXBTG. .HUVNEDAMFZPI 
IQYOJCWKSXBTG. . HUVNEDAMFZP 

Finusi 12. 

Here A p =D t but U P =H„ not 0*. However, if the “dovetailing” is commenced with the letter S, 
of Figure 9 and the resultant 26-letter sequence is juxtaposed against itself as shown in Figure 13, 
it will be found that the sequence will now satisfy all the requirements 

QSOBCGK . XUTN . DHMVZEIAYFJPW 
IAYFJPWQSOBCGK . XUTN DHMVZE 

PlOURl 13 

The sequence iB, of course, a decimation of the QUESTIONABLY . . . sequence, at the third interval 
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